iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done

Nicholas Bellinger · Nicholas Bellinger · commit fce50a2fa4e9 · 2017-07-06T23:11:35.000-07:00
This patch fixes a NULL pointer dereference in isert_login_recv_done() of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error() resetting isert_conn->cm_id = NULL during a failed login attempt. As per Sagi, we will always see the completion of all recv wrs posted on the qp (given that we assigned a ->done handler), this is a FLUSH error completion, we just don't get to verify that because we deref NULL before. The issue here, was the assumption that dereferencing the connection cm_id is always safe, which is not true since: commit 4a579da Author: Sagi Grimberg <sagig@mellanox.com> Date: Sun Mar 29 15:52:04 2015 +0300 iser-target: Fix possible deadlock in RDMA_CM connection error As I see it, we have a direct reference to the isert_device from isert_conn which is the one-liner fix that we actually need like we do in isert_rdma_read_done() and isert_rdma_write_done(). Reported-by: Andrea Righi <righi.andrea@gmail.com> Tested-by: Andrea Righi <righi.andrea@gmail.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Cc: <stable@vger.kernel.org> # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -1452,7 +1452,7 @@ static void
 isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
 {
 	struct isert_conn *isert_conn = wc->qp->qp_context;
-	struct ib_device *ib_dev = isert_conn->cm_id->device;
+	struct ib_device *ib_dev = isert_conn->device->ib_device;
 
 	if (unlikely(wc->status != IB_WC_SUCCESS)) {
 		isert_print_wc(wc, "login recv");

Original file line number	Diff line number	Diff line change
`@@ -1452,7 +1452,7 @@ static void`
`1452`	`1452`	`isert_login_recv_done(struct ib_cq cq, struct ib_wc wc)`
`1453`	`1453`	`{`
`1454`	`1454`	`struct isert_conn *isert_conn = wc->qp->qp_context;`
`1455`		`- struct ib_device *ib_dev = isert_conn->cm_id->device;`
	`1455`	`+ struct ib_device *ib_dev = isert_conn->device->ib_device;`
`1456`	`1456`
`1457`	`1457`	`if (unlikely(wc->status != IB_WC_SUCCESS)) {`
`1458`	`1458`	`isert_print_wc(wc, "login recv");`