diff options
| author | Nicholas Bellinger <nab@linux-iscsi.org> | 2017-06-29 22:21:31 -0700 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2017-09-10 16:36:00 -0400 |
| commit | 5a8dd1617578abd5bce04592e5be581423afe73c (patch) | |
| tree | fed7d45a6a3fa7a647f8aa24832c1ed0b1362737 /drivers | |
| parent | 947dd1adf065ec201d0b1196366b74807e26b735 (diff) | |
iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
[ Upstream commit fce50a2fa4e9c6e103915c351b6d4a98661341d6 ]
This patch fixes a NULL pointer dereference in isert_login_recv_done()
of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error()
resetting isert_conn->cm_id = NULL during a failed login attempt.
As per Sagi, we will always see the completion of all recv wrs posted
on the qp (given that we assigned a ->done handler), this is a FLUSH
error completion, we just don't get to verify that because we deref
NULL before.
The issue here, was the assumption that dereferencing the connection
cm_id is always safe, which is not true since:
commit 4a579da2586bd3b79b025947ea24ede2bbfede62
Author: Sagi Grimberg <sagig@mellanox.com>
Date: Sun Mar 29 15:52:04 2015 +0300
iser-target: Fix possible deadlock in RDMA_CM connection error
As I see it, we have a direct reference to the isert_device from
isert_conn which is the one-liner fix that we actually need like
we do in isert_rdma_read_done() and isert_rdma_write_done().
Reported-by: Andrea Righi <righi.andrea@gmail.com>
Tested-by: Andrea Righi <righi.andrea@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/ulp/isert/ib_isert.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index b52a704c3449..2d515a544f33 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -1586,7 +1586,7 @@ isert_rcv_completion(struct iser_rx_desc *desc, struct isert_conn *isert_conn, u32 xfer_len) { - struct ib_device *ib_dev = isert_conn->cm_id->device; + struct ib_device *ib_dev = isert_conn->device->ib_device; struct iscsi_hdr *hdr; u64 rx_dma; int rx_buflen, outstanding; |