From patchwork Fri Jun 2 10:56:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saravanan Vajravel X-Patchwork-Id: 13265103 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BE53C77B7A for ; Fri, 2 Jun 2023 10:56:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235177AbjFBK4q (ORCPT ); Fri, 2 Jun 2023 06:56:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235331AbjFBK4p (ORCPT ); Fri, 2 Jun 2023 06:56:45 -0400 Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1A799C0 for ; Fri, 2 Jun 2023 03:56:45 -0700 (PDT) Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-64d4e4598f0so2202990b3a.2 for ; Fri, 02 Jun 2023 03:56:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1685703404; x=1688295404; h=mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to; bh=9ifOSXOAKhBVTbhgGZLCA3N7vHGMbzM1QoFBbMHynXE=; b=hNoE2H1bkwyidEMTRzHkuZGwZLgjHpMOEKV6oMyhXLi5dsc+K9Ec2HqRC9sg3gx5mi ciBCc2tr1V3mIlv+N04V92UqWWAbmomKPKx2U8jNpW/gDh80Xf9hGA5kLL9L/fJVhqYH mMVTLf4GN9tfsQNVE/wfIueUdJGd1taq0KCB0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685703404; x=1688295404; h=mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=9ifOSXOAKhBVTbhgGZLCA3N7vHGMbzM1QoFBbMHynXE=; b=J41X1EtLe2zM4Eb4ZDPYrAhYrfyUvOkmOULdTn5lgnH4IMH3suz/sanY+7Az3dLhlC Xa1bSmWT/IAcduUR92RL1GuKgBV6IuV45e9Hj46O3upu9lVJBlYV73emDZ/H7y3XuwFM V6cXsjW0qb5Eso8i7e3dVAdAwYG8I6KVhppNzWfBRVEodK0kQ+HuqNfHJszk4v43N75z fL5Yd4XZNEQmH0mtEc2tmmvECMpyeSZPVvq+Bb+lVhQERkBVG//jQeqFbprpQWtpybys gwHcDDxPIU5l3nlH8NgkqxZZRR0IwwGinwE2mhR0DERUG/x9rehH8v68tjdFzpY0StPS RqjA== X-Gm-Message-State: AC+VfDzNT/77zkwldpr5EFCPPOQ12LP1oirElwxa40M7jLcEQZFB3r/K YiELqzYdWw5PHFaNtFIzvuwbQA== X-Google-Smtp-Source: ACHHUZ49VinZCQTGqFkv0/1EgzIMyMkPLP2HVgLAbX+8bwsHmEeW9/Dq9cm2q5/mE0PvZkKqCsbmng== X-Received: by 2002:a05:6a00:230f:b0:641:3bf8:6514 with SMTP id h15-20020a056a00230f00b006413bf86514mr16497826pfh.10.1685703404393; Fri, 02 Jun 2023 03:56:44 -0700 (PDT) Received: from localhost.localdomain ([192.19.234.250]) by smtp.gmail.com with ESMTPSA id s9-20020aa78d49000000b0064f708ca12asm792315pfe.70.2023.06.02.03.56.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Jun 2023 03:56:44 -0700 (PDT) From: Saravanan Vajravel To: selvin.xavier@broadcom.com, jgg@ziepe.ca, leon@kernel.org, sagi@grimberg.me Cc: linux-rdma@vger.kernel.org, Saravanan Vajravel Subject: [PATCH v2 for-rc 3/3] IB/isert: Fix incorrect release of isert connextion Date: Fri, 2 Jun 2023 03:56:13 -0700 Message-Id: <20230602105613.95952-4-saravanan.vajravel@broadcom.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230602105613.95952-1-saravanan.vajravel@broadcom.com> References: <20230602105613.95952-1-saravanan.vajravel@broadcom.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org The ib_isert module is releasing the isert connection both in isert_wait_conn() handler as well as isert_free_conn() handler. In isert_wait_conn() handler, it is expected to wait for iSCSI session logout operation to complete. It should free the isert connection only in isert_free_conn() handler. When a bunch of iSER target is cleared, this issue can lead to use-after-free memory issue as isert conn is twice released Fixes: 0fc4ea701fcf ("Target/iser: Don't put isert_conn inside disconnected handler") Signed-off-by: Saravanan Vajravel Signed-off-by: Selvin Xavier --- drivers/infiniband/ulp/isert/ib_isert.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index 7214a9bba524..c6b94a52afe2 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -2570,8 +2570,6 @@ static void isert_wait_conn(struct iscsit_conn *conn) isert_put_unsol_pending_cmds(conn); isert_wait4cmds(conn); isert_wait4logout(isert_conn); - - queue_work(isert_release_wq, &isert_conn->release_work); } static void isert_free_conn(struct iscsit_conn *conn)