Nicholas Bellinger fce50a2fa4 iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done ... This patch fixes a NULL pointer dereference in isert_login_recv_done() of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error() resetting isert_conn->cm_id = NULL during a failed login attempt. As per Sagi, we will always see the completion of all recv wrs posted on the qp (given that we assigned a ->done handler), this is a FLUSH error completion, we just don't get to verify that because we deref NULL before. The issue here, was the assumption that dereferencing the connection cm_id is always safe, which is not true since: commit 4a579da258 Author: Sagi Grimberg <sagig@mellanox.com> Date: Sun Mar 29 15:52:04 2015 +0300 iser-target: Fix possible deadlock in RDMA_CM connection error As I see it, we have a direct reference to the isert_device from isert_conn which is the one-liner fix that we actually need like we do in isert_rdma_read_done() and isert_rdma_write_done(). Reported-by: Andrea Righi <righi.andrea@gmail.com> Tested-by: Andrea Righi <righi.andrea@gmail.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Cc: <stable@vger.kernel.org> # 3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>		2017-07-06 23:11:35 -07:00
..
ipoib	IB/ipoib: add get_link_ksettings in ethtool	2017-05-04 19:31:46 -04:00
iser	IB/iser: fix spelling mistake: "unexepected" -> "unexpected"	2017-04-25 14:06:49 -04:00
isert	iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done	2017-07-06 23:11:35 -07:00
opa_vnic	IB/core: Define 'ib' and 'roce' rdma_ah_attr types	2017-05-01 14:32:43 -04:00
srp	IB/SA: Add support to query OPA path records	2017-05-01 14:39:02 -04:00
srpt	IB/srpt: Make a debug statement in srpt_abort_cmd() more informative	2017-07-06 22:58:01 -07:00
Makefile	IB/opa-vnic: Virtual Network Interface Controller (VNIC) netdev	2017-04-20 12:01:38 -04:00