linux-toradex.git/drivers/infiniband/ulp/isert, branch v4.1.10

iser-target: Fix possible use-after-free

2015-06-09T05:17:09+00:00

iser connection termination process happens in 2 stages:
- isert_wait_conn:
  - resumes rdma disconnect
  - wait for session commands
  - wait for flush completions (post a marked wr to signal we are done)
  - wait for logout completion
  - queue work for connection cleanup (depends on disconnected/timewait
    events)
- isert_free_conn
  - last reference put on the connection

In case we are terminating during IOs, we might be posting send/recv
requests after we posted the last work request which might lead
to a use-after-free condition in isert_handle_wc.
After we posted the last wr in isert_wait_conn we are guaranteed that
no successful completions will follow (meaning no new work request posts
may happen) but other flush errors might still come. So before we
put the last reference on the connection, we repeat the process of
posting a marked work request (isert_wait4flush) in order to make sure all
pending completions were flushed.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Jenny Falkovich 
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger

iser-target: release stale iser connections

2015-06-09T05:16:40+00:00

When receiving a new iser connect request we serialize
the pending requests by adding the newly created iser connection
to the np accept list and let the login thread process the connect
request one by one (np_accept_wait).

In case we received a disconnect request before the iser_conn
has begun processing (still linked in np_accept_list) we should
detach it from the list and clean it up and not have the login
thread process a stale connection. We do it only when the connection
state is not already terminating (initiator driven disconnect) as
this might lead us to access np_accept_mutex after the np was released
in live shutdown scenarios.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Jenny Falkovich 
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger

iser-target: Fix variable-length response error completion

2015-06-09T05:16:17+00:00

Since commit "2426bd456a6 target: Report correct response ..."
we might get a command with data_size that does not fit to
the number of allocated data sg elements. Given that we rely on
cmd t_data_nents which might be different than the data_size,
we sometimes receive local length error completion. The correct
approach would be to take the command data_size into account when
constructing the ib sg_list.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Jenny Falkovich 
Cc: stable@vger.kernel.org # 3.16+
Signed-off-by: Nicholas Bellinger

iser-target: Fix error path in isert_create_pi_ctx()

2015-05-31T03:01:04+00:00

We don't assign pi_ctx to desc->pi_ctx until we're certain to succeed
in the function.  That means the cleanup path should use the local
pi_ctx variable, not desc->pi_ctx.

This was detected by Coverity (CID 1260062).

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger

iser-target: Bump version to 1.0

2015-04-08T06:27:57+00:00

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger

iser-target: Remove conn_ prefix from struct isert_conn members

2015-04-08T06:27:57+00:00

These variables are always accessed via struct isert_conn so
no need to have a "conn_" prefix for them.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger

iser-target: Remove un-needed rdma_listen backlog

2015-04-08T06:27:56+00:00

iser target can handle as many connect request as
the fabric sends to it. This backlog should not set as
a back-pressure mechanism (which is not very useful).

isert does need a back-pressure mechanism, but it should
be added in isert by monitoring the number of pending
established connections (will be added in a later stage).

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger

iser-target: Remove redundant check on the device

2015-04-08T06:27:56+00:00

In iser_connect_release there is no chance that
the iser device is set to NULL, if this happens
we have a BUG. So use BUG_ON.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger

iser-target: Get rid of redundant max_accept

2015-04-08T06:27:55+00:00

Not sure what it was used for, but there is
no real need for it now as I see it. Go ahead
and get rid of it.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger

iser-target: Split some logic in isert_connect_request to routines

2015-04-08T06:27:55+00:00

Move login buffer alloc/free code to dedicated
routines and introduce isert_conn_init which
initializes the connection lists and locks.

Simplifies and cleans up the code a little bit.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger