| From fce50a2fa4e9c6e103915c351b6d4a98661341d6 Mon Sep 17 00:00:00 2001 |
| From: Nicholas Bellinger <nab@linux-iscsi.org> |
| Date: Thu, 29 Jun 2017 22:21:31 -0700 |
| Subject: iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done |
| |
| From: Nicholas Bellinger <nab@linux-iscsi.org> |
| |
| commit fce50a2fa4e9c6e103915c351b6d4a98661341d6 upstream. |
| |
| This patch fixes a NULL pointer dereference in isert_login_recv_done() |
| of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error() |
| resetting isert_conn->cm_id = NULL during a failed login attempt. |
| |
| As per Sagi, we will always see the completion of all recv wrs posted |
| on the qp (given that we assigned a ->done handler), this is a FLUSH |
| error completion, we just don't get to verify that because we deref |
| NULL before. |
| |
| The issue here, was the assumption that dereferencing the connection |
| cm_id is always safe, which is not true since: |
| |
| commit 4a579da2586bd3b79b025947ea24ede2bbfede62 |
| Author: Sagi Grimberg <sagig@mellanox.com> |
| Date: Sun Mar 29 15:52:04 2015 +0300 |
| |
| iser-target: Fix possible deadlock in RDMA_CM connection error |
| |
| As I see it, we have a direct reference to the isert_device from |
| isert_conn which is the one-liner fix that we actually need like |
| we do in isert_rdma_read_done() and isert_rdma_write_done(). |
| |
| Reported-by: Andrea Righi <righi.andrea@gmail.com> |
| Tested-by: Andrea Righi <righi.andrea@gmail.com> |
| Reviewed-by: Sagi Grimberg <sagi@grimberg.me> |
| Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/infiniband/ulp/isert/ib_isert.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/infiniband/ulp/isert/ib_isert.c |
| +++ b/drivers/infiniband/ulp/isert/ib_isert.c |
| @@ -1581,7 +1581,7 @@ isert_rcv_completion(struct iser_rx_desc |
| struct isert_conn *isert_conn, |
| u32 xfer_len) |
| { |
| - struct ib_device *ib_dev = isert_conn->cm_id->device; |
| + struct ib_device *ib_dev = isert_conn->device->ib_device; |
| struct iscsi_hdr *hdr; |
| u64 rx_dma; |
| int rx_buflen; |