android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IB/isert: Fix incorrect release of isert connection

Browse Source 
[ Upstream commit 699826f4e30ab76a62c238c86fbef7e826639c8d ]

The ib_isert module is releasing the isert connection both in
isert_wait_conn() handler as well as isert_free_conn() handler.
In isert_wait_conn() handler, it is expected to wait for iSCSI
session logout operation to complete. It should free the isert
connection only in isert_free_conn() handler.

When a bunch of iSER target is cleared, this issue can lead to
use-after-free memory issue as isert conn is twice released

Fixes: b02efbfc9a ("iser-target: Fix implicit termination of connections")
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://lore.kernel.org/r/20230606102531.162967-4-saravanan.vajravel@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Saravanan Vajravel 2023-06-06 03:25:31 -07:00 committed by Greg Kroah-Hartman
parent da6ae4aab5
commit 3c97f2c9ec
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/infiniband/ulp/isert/ib_isert.c
View File

@ -2560,8 +2560,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
isert_put_unsol_pending_cmds(conn); isert_put_unsol_pending_cmds(conn);
isert_wait4cmds(conn); isert_wait4cmds(conn);
isert_wait4logout(isert_conn); isert_wait4logout(isert_conn);
queue_work(isert_release_wq, &isert_conn->release_work);
} }
static void isert_free_conn(struct iscsi_conn *conn) static void isert_free_conn(struct iscsi_conn *conn)