Patch "IB/isert: Fix possible list corruption in CMA handler" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    IB/isert: Fix possible list corruption in CMA handler

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ib-isert-fix-possible-list-corruption-in-cma-handler.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bc3f6f6beecc00ebdbc61451e8ff4e6e9946b24b
Author: Saravanan Vajravel <saravanan.vajravel@xxxxxxxxxxxx>
Date:   Tue Jun 6 03:25:30 2023 -0700

    IB/isert: Fix possible list corruption in CMA handler
    
    [ Upstream commit 7651e2d6c5b359a28c2d4c904fec6608d1021ca8 ]
    
    When ib_isert module receives connection error event, it is
    releasing the isert session and removes corresponding list
    node but it doesn't take appropriate mutex lock to remove
    the list node.  This can lead to linked  list corruption
    
    Fixes: bd3792205aae ("iser-target: Fix pending connections handling in target stack shutdown sequnce")
    Signed-off-by: Selvin Xavier <selvin.xavier@xxxxxxxxxxxx>
    Signed-off-by: Saravanan Vajravel <saravanan.vajravel@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230606102531.162967-3-saravanan.vajravel@xxxxxxxxxxxx
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 988b957107cc1..ed375f517e8ac 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -656,9 +656,13 @@ static int
 isert_connect_error(struct rdma_cm_id *cma_id)
 {
 	struct isert_conn *isert_conn = cma_id->qp->qp_context;
+	struct isert_np *isert_np = cma_id->context;
 
 	ib_drain_qp(isert_conn->qp);
+
+	mutex_lock(&isert_np->mutex);
 	list_del_init(&isert_conn->node);
+	mutex_unlock(&isert_np->mutex);
 	isert_conn->cm_id = NULL;
 	isert_put_conn(isert_conn);
 



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux