linux/drivers/infiniband/ulp
Sagi Grimberg 524630d582 iser-target: Fix possible use-after-free
iser connection termination process happens in 2 stages:
- isert_wait_conn:
  - resumes rdma disconnect
  - wait for session commands
  - wait for flush completions (post a marked wr to signal we are done)
  - wait for logout completion
  - queue work for connection cleanup (depends on disconnected/timewait
    events)
- isert_free_conn
  - last reference put on the connection

In case we are terminating during IOs, we might be posting send/recv
requests after we posted the last work request which might lead
to a use-after-free condition in isert_handle_wc.
After we posted the last wr in isert_wait_conn we are guaranteed that
no successful completions will follow (meaning no new work request posts
may happen) but other flush errors might still come. So before we
put the last reference on the connection, we repeat the process of
posting a marked work request (isert_wait4flush) in order to make sure all
pending completions were flushed.

Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Jenny Falkovich <jennyf@mellanox.com>
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2015-06-08 22:17:09 -07:00
..
ipoib InfiniBand/RDMA updates for 4.1: 2015-04-22 11:50:05 -07:00
iser IB/iser: Rewrite bounce buffer code path 2015-04-15 16:07:14 -04:00
isert iser-target: Fix possible use-after-free 2015-06-08 22:17:09 -07:00
srp IB/srp: Use P_Key cache for P_Key lookups 2015-04-15 16:06:54 -04:00
srpt Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2015-04-24 10:22:09 -07:00
Makefile IB: Allow build of hw/ and ulp/ subdirectories independently 2014-06-02 14:51:12 -07:00