OpenCloudOS-Kernel/drivers/infiniband/ulp/isert
Nicholas Bellinger ce9a9fc20a iser-target: Fix REJECT CM event use-after-free OOPs
This patch fixes a bug in iser-target code where the REJECT CM event
handler code currently performs a isert_put_conn() for the final
isert_conn->kref put, while iscsi_np process context is still blocked
in isert_get_login_rx().

Once isert_get_login_rx() is awoking due to login timeout, iscsi_np
process context will attempt to invoke iscsi_target_login_sess_out()
to cleanup iscsi_conn as expected, and calls isert_wait_conn() +
isert_free_conn() which triggers the use-after-free OOPs.

To address this bug, move the kref_get_unless_zero() call from
isert_connected_handler() into isert_connect_request() immediately
preceeding isert_rdma_accept() to ensure the CM handler cleanup
paths and isert_free_conn() are always operating with two refs.

Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-07-24 14:19:45 -07:00
..
Kconfig treewide: Fix typo in Kconfig 2013-10-14 15:23:02 +02:00
Makefile iser-target: Add iSCSI Extensions for RDMA (iSER) target driver 2013-04-25 01:09:41 -07:00
ib_isert.c iser-target: Fix REJECT CM event use-after-free OOPs 2015-07-24 14:19:45 -07:00
ib_isert.h iser-target: Remove conn_ prefix from struct isert_conn members 2015-04-07 23:27:57 -07:00
isert_proto.h iser-target: Add iSCSI Extensions for RDMA (iSER) target driver 2013-04-25 01:09:41 -07:00