Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f562a0b authored by Ariel Nahum's avatar Ariel Nahum Committed by Roland Dreier
Browse files

IB/iser: Fix possible NULL derefernce ib_conn->device in session_create 



If rdma_cm error event comes after ep_poll but before conn_bind, we
should protect against dereferncing the device (which may have been
terminated) in session_create and conn_create (already protected)
callbacks.

Signed-off-by: default avatarAriel Nahum <arieln@mellanox.com>
Signed-off-by: default avatarSagi Grimberg <sagig@mellanox.com>
Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent 49df2781

drivers/infiniband/ulp/iser/iscsi_iser.c

+18 −4
Original line number Diff line number Diff line
@@ -588,6 +588,15 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, 
	if (ep) {

		iser_conn = ep->dd_data;

		max_cmds = iser_conn->max_cmds;



		mutex_lock(&iser_conn->state_mutex);

		if (iser_conn->state != ISER_CONN_UP) {

			iser_err("iser conn %p already started teardown\n",

				 iser_conn);

			mutex_unlock(&iser_conn->state_mutex);

			goto free_host;

		}



		ib_conn = &iser_conn->ib_conn;

		if (ib_conn->pi_support) {

			u32 sig_caps = ib_conn->device->dev_attr.sig_prot_cap;
@@ -598,13 +607,18 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, 
			else

				scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);

		}



		if (iscsi_host_add(shost,

				   ib_conn->device->ib_device->dma_device)) {

			mutex_unlock(&iser_conn->state_mutex);

			goto free_host;

		}

		mutex_unlock(&iser_conn->state_mutex);

	} else {

		max_cmds = ISER_DEF_XMIT_CMDS_MAX;

	}



	if (iscsi_host_add(shost, ep ?

			   ib_conn->device->ib_device->dma_device : NULL))

		if (iscsi_host_add(shost, NULL))

			goto free_host;

	}



	if (cmds_max > max_cmds) {

		iser_info("cmds_max changed from %u to %u\n",