Re: [PATCH] ib_isert: prevent NULL pointer dereference in isert_login_recv_done() (was: Re: NULL pointer dereference in isert_login_recv_done in 4.9.32)
From: Andrea Righi <hidden>
Date: 2017-06-28 17:54:21
Also in:
lkml
On Sun, Jun 25, 2017 at 04:58:04PM -0700, Nicholas A. Bellinger wrote: ...
So I assume isert_cma_handler() -> isert_connect_error() getting called to clear isert_conn->cm_id before connection established, and subsequently isert_conn->login_req_buf->rx_cqe.done() -> isert_login_recv_done() still getting invoked after connection failure is new RDMA API behavior.. That said, following Sagi's original patch that added the clearing of isert_conn->cm_id to isert_connect_error(), it probably makes sense to use isert_conn->device->ib_device, and avoid dereferencing isert_conn->cm_id before connection is established. Here's a quick (untested) patch to do this for recv/send done callbacks, and avoid using isert_conn->cm_id during isert_rdma_accept(). Sagi + Co, WDYT..?
Just tested this patch, I wasn't able to reproduce the NULL pointer dereference or any other bugs, so this fix seems safe enough to me. Tested-by: Andrea Righi <redacted>
quoted hunk ↗ jump to hunk
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index fcbed35..f7f97f3 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c@@ -52,7 +52,7 @@ static int isert_login_post_recv(struct isert_conn *isert_conn); static int -isert_rdma_accept(struct isert_conn *isert_conn); +isert_rdma_accept(struct isert_conn *isert_conn, struct rdma_cm_id *cm_id); struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); static void isert_release_work(struct work_struct *work);@@ -543,7 +543,7 @@ if (ret) goto out_conn_dev; - ret = isert_rdma_accept(isert_conn); + ret = isert_rdma_accept(isert_conn, cma_id); if (ret) goto out_conn_dev;@@ -1452,7 +1452,7 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) { struct isert_conn *isert_conn = wc->qp->qp_context; - struct ib_device *ib_dev = isert_conn->cm_id->device; + struct ib_device *ib_dev = isert_conn->device->ib_device; if (unlikely(wc->status != IB_WC_SUCCESS)) { isert_print_wc(wc, "login recv");@@ -1769,7 +1769,7 @@ isert_login_send_done(struct ib_cq *cq, struct ib_wc *wc) { struct isert_conn *isert_conn = wc->qp->qp_context; - struct ib_device *ib_dev = isert_conn->cm_id->device; + struct ib_device *ib_dev = isert_conn->device->ib_device; struct iser_tx_desc *tx_desc = cqe_to_tx_desc(wc->wr_cqe); if (unlikely(wc->status != IB_WC_SUCCESS)) {@@ -2369,9 +2369,8 @@ struct rdma_cm_id * } static int -isert_rdma_accept(struct isert_conn *isert_conn) +isert_rdma_accept(struct isert_conn *isert_conn, struct rdma_cm_id *cm_id) { - struct rdma_cm_id *cm_id = isert_conn->cm_id; struct rdma_conn_param cp; int ret; struct iser_cm_hdr rsp_hdr;