Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932226AbbF0BOb (ORCPT ); Fri, 26 Jun 2015 21:14:31 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:47540 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755339AbbF0BJc (ORCPT ); Fri, 26 Jun 2015 21:09:32 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sagi Grimberg , Jenny Falkovich , Nicholas Bellinger Subject: [PATCH 4.0 09/22] iser-target: Fix possible use-after-free Date: Fri, 26 Jun 2015 18:08:51 -0700 Message-Id: <20150627010854.350105472@linuxfoundation.org> X-Mailer: git-send-email 2.4.4 In-Reply-To: <20150627010854.064848055@linuxfoundation.org> References: <20150627010854.064848055@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1981 Lines: 55 4.0-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sagi Grimberg commit 524630d5824c7a75aab568c6bd1423fd748cd3bb upstream. iser connection termination process happens in 2 stages: - isert_wait_conn: - resumes rdma disconnect - wait for session commands - wait for flush completions (post a marked wr to signal we are done) - wait for logout completion - queue work for connection cleanup (depends on disconnected/timewait events) - isert_free_conn - last reference put on the connection In case we are terminating during IOs, we might be posting send/recv requests after we posted the last work request which might lead to a use-after-free condition in isert_handle_wc. After we posted the last wr in isert_wait_conn we are guaranteed that no successful completions will follow (meaning no new work request posts may happen) but other flush errors might still come. So before we put the last reference on the connection, we repeat the process of posting a marked work request (isert_wait4flush) in order to make sure all pending completions were flushed. Signed-off-by: Sagi Grimberg Signed-off-by: Jenny Falkovich Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/ulp/isert/ib_isert.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -3313,6 +3313,7 @@ static void isert_free_conn(struct iscsi { struct isert_conn *isert_conn = conn->context; + isert_wait4flush(isert_conn); isert_put_conn(isert_conn); } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/