From patchwork Tue Jun 6 10:25:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saravanan Vajravel X-Patchwork-Id: 13268913 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E685CC77B73 for ; Tue, 6 Jun 2023 10:25:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234679AbjFFKZ4 (ORCPT ); Tue, 6 Jun 2023 06:25:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233398AbjFFKZz (ORCPT ); Tue, 6 Jun 2023 06:25:55 -0400 Received: from mail-oo1-xc32.google.com (mail-oo1-xc32.google.com [IPv6:2607:f8b0:4864:20::c32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 836F0E6A for ; Tue, 6 Jun 2023 03:25:54 -0700 (PDT) Received: by mail-oo1-xc32.google.com with SMTP id 006d021491bc7-55586f22ab7so4559148eaf.2 for ; Tue, 06 Jun 2023 03:25:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1686047154; x=1688639154; h=mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to; bh=yJKKzrwlqfmxlwH7XqPgONSYjmkmujF1ekuEtIRJmM0=; b=HjetvJgxS2lPynv1/ElD3gUnJ2gtCemfAQGlK02AgwbAjs1wqWqGq5LsaXF5h8UX57 PhuoEP01aaeGxGinGdRp68bdAB+S5+zxn3MYsT4I4z3yVJERmBRRUKdRptI3Wd6cczJK O1/qbohGxTtT5cHARmXm+RHJrqMa7TW7BkJGs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686047154; x=1688639154; h=mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=yJKKzrwlqfmxlwH7XqPgONSYjmkmujF1ekuEtIRJmM0=; b=bWuSZjmwfIX858E7fID2pVbI1r/crMQY31ytCxRYhA0wEU6Y+oaSspRZ+geige8Hs6 k9YHKeOYwsr4XGqaFU+6aTyWI2K+euovZcpLgb3+loss9GBISy/50yAN0zyfhAZKR+4x vO2HaRiD8Ccs1WQ3LYjNo6EJt2Ln4i5PpkcABS8MVJjyAxX304478dGCvT1XkHJXi/SK CYPddSNZY2d7dv7SsOlXPBp9D9MsTmCwnMgfn5xIiU96HPOA7eYpd7YUBXIGW+Wbrnpg g0qT5LlvUPrM53Tzsrm74kaf8zlN4m3DohBHNB1Dn3qoo9oWJY6rI5m+dNnVjXGRxNUN h/IA== X-Gm-Message-State: AC+VfDzS2MpzJqa87RXn74Z+Pu24xyVtAjB1JRLgwgkIfX59jx7TgdEu XnXiox0LsNOUTIHov1p84F/+yHfUFyIHPxsYmKo= X-Google-Smtp-Source: ACHHUZ7C27yyms1PFVNBrVl+FbqTDQJvoQkQfPltnvAK77PykBds4qi3MdQe5MPzcUedjMWo067BXQ== X-Received: by 2002:a05:6358:bb8f:b0:129:8c5e:84c1 with SMTP id df15-20020a056358bb8f00b001298c5e84c1mr2153324rwb.32.1686047153589; Tue, 06 Jun 2023 03:25:53 -0700 (PDT) Received: from localhost.localdomain ([192.19.234.250]) by smtp.gmail.com with ESMTPSA id i12-20020a17090a2a0c00b0024c1ac09394sm7881770pjd.19.2023.06.06.03.25.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Jun 2023 03:25:53 -0700 (PDT) From: Saravanan Vajravel To: selvin.xavier@broadcom.com, jgg@ziepe.ca, leon@kernel.org, sagi@grimberg.me Cc: linux-rdma@vger.kernel.org, Saravanan Vajravel Subject: [PATCH v3 for-rc 2/3] IB/isert: Fix possible list corruption in CMA handler Date: Tue, 6 Jun 2023 03:25:30 -0700 Message-Id: <20230606102531.162967-3-saravanan.vajravel@broadcom.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230606102531.162967-1-saravanan.vajravel@broadcom.com> References: <20230606102531.162967-1-saravanan.vajravel@broadcom.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org When ib_isert module receives connection error event, it is releasing the isert session and removes corresponding list node but it doesn't take appropriate mutex lock to remove the list node. This can lead to linked list corruption Fixes: bd3792205aae ("iser-target: Fix pending connections handling in target stack shutdown sequnce") Signed-off-by: Selvin Xavier Signed-off-by: Saravanan Vajravel --- drivers/infiniband/ulp/isert/ib_isert.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index b4809d237250..00a7303c8cc6 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -657,9 +657,13 @@ static int isert_connect_error(struct rdma_cm_id *cma_id) { struct isert_conn *isert_conn = cma_id->qp->qp_context; + struct isert_np *isert_np = cma_id->context; ib_drain_qp(isert_conn->qp); + + mutex_lock(&isert_np->mutex); list_del_init(&isert_conn->node); + mutex_unlock(&isert_np->mutex); isert_conn->cm_id = NULL; isert_put_conn(isert_conn);