Re: [PATCH v3 2/2] IB/isert: reject full-feature PDUs that arrive before registration

[Leon Romanovsky]

On Thu, Jul 30, 2026 at 10:51:10PM +0900, Yehyeong Lee wrote:
> The full-feature receive buffers are posted from isert_put_login_tx(),
> which runs before __transport_register_session().  An initiator that does
> not wait for the final Login Response can therefore still have a SCSI
> command executed against an se_session whose se_tpg is NULL, with the same
> oops as the previous patch.
> 
> Move the ISER_CONN_FULL_FEATURE transition into isert_get_rx_pdu(), where
> it happens after the session has been registered, and reinstate the
> connection on any PDU that arrives before it, the same call this function
> already makes when a work completion fails.  The state is read without
> isert_conn->mutex because isert_recv_done() runs on ib-comp-wq; the acquire
> load pairs with the release store so that the session registration
> preceding it is visible.
> 
> Measured over rxe with an initiator that fires SCSI commands into that
> window without waiting for the Login Response, 400 login cycles per run:
> the oops appeared in 7 of 10 runs with only the previous patch applied and
> in 0 of 10 runs with this one on top.  The check fired 22 times across
> those 10 runs, 16 in ISER_CONN_BOUND and 6 in ISER_CONN_TERMINATING, where
> the reinstatement is a no-op because teardown has already latched.
> Well-formed traffic is unaffected: 20 runs of a spec-conforming initiator,
> 400 login cycles each, pass with the check never firing.
> 
> Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
> ---
> v3: unmap login_tx_desc in isert_connect_release() (1/2); make the
>     FULL_FEATURE store a release and the state check an acquire load, and
>     log the value actually tested (2/2).  Both from Sashiko's review of v2.
>     v2: https://lore.kernel.org/all/20260730063124.1554460-1-yhlee@xxxxxxxxxxxxxxxxxx/

Sashiko is still not satisfied with this patch.

Thanks