Nicholas Bellinger fce50a2fa4 iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done ... This patch fixes a NULL pointer dereference in isert_login_recv_done() of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error() resetting isert_conn->cm_id = NULL during a failed login attempt. As per Sagi, we will always see the completion of all recv wrs posted on the qp (given that we assigned a ->done handler), this is a FLUSH error completion, we just don't get to verify that because we deref NULL before. The issue here, was the assumption that dereferencing the connection cm_id is always safe, which is not true since: commit 4a579da258 Author: Sagi Grimberg <sagig@mellanox.com> Date: Sun Mar 29 15:52:04 2015 +0300 iser-target: Fix possible deadlock in RDMA_CM connection error As I see it, we have a direct reference to the isert_device from isert_conn which is the one-liner fix that we actually need like we do in isert_rdma_read_done() and isert_rdma_write_done(). Reported-by: Andrea Righi <righi.andrea@gmail.com> Tested-by: Andrea Righi <righi.andrea@gmail.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Cc: <stable@vger.kernel.org> # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>		2017-07-06 23:11:35 -07:00
..
core	char/misc patches for 4.12-rc1	2017-05-04 19:15:35 -07:00
hw	IOMMU Updates for Linux v4.12	2017-05-09 15:15:47 -07:00
sw	rxe: expose num_possible_cpus() cnum_comp_vectors	2017-05-04 19:33:02 -04:00
ulp	iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done	2017-07-06 23:11:35 -07:00
Kconfig	IB/opa-vnic: Virtual Network Interface Controller (VNIC) netdev	2017-04-20 12:01:38 -04:00
Makefile