Re: [PATCH] ib_isert: prevent NULL pointer dereference in isert_login_recv_done() (was: Re: NULL pointer dereference in isert_login_recv_done in 4.9.32)

[Andrea Righi]

On Sun, Jun 25, 2017 at 04:58:04PM -0700, Nicholas A. Bellinger wrote:
...
> So I assume isert_cma_handler() -> isert_connect_error() getting called
> to clear isert_conn->cm_id before connection established, and
> subsequently isert_conn->login_req_buf->rx_cqe.done() ->
> isert_login_recv_done() still getting invoked after connection failure
> is new RDMA API behavior..
> 
> That said, following Sagi's original patch that added the clearing of
> isert_conn->cm_id to isert_connect_error(), it probably makes sense to
> use isert_conn->device->ib_device, and avoid dereferencing
> isert_conn->cm_id before connection is established.
> 
> Here's a quick (untested) patch to do this for recv/send done callbacks,
> and avoid using isert_conn->cm_id during isert_rdma_accept().
> 
> Sagi + Co, WDYT..?

Just tested this patch, I wasn't able to reproduce the NULL pointer
dereference or any other bugs, so this fix seems safe enough to me.

Tested-by: Andrea Righi <righi.andrea@xxxxxxxxx>

> 
> diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
> index fcbed35..f7f97f3 100644
> --- a/drivers/infiniband/ulp/isert/ib_isert.c
> +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> @@ -52,7 +52,7 @@
>  static int
>  isert_login_post_recv(struct isert_conn *isert_conn);
>  static int
> -isert_rdma_accept(struct isert_conn *isert_conn);
> +isert_rdma_accept(struct isert_conn *isert_conn, struct rdma_cm_id *cm_id);
>  struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
>  
>  static void isert_release_work(struct work_struct *work);
> @@ -543,7 +543,7 @@
>  	if (ret)
>  		goto out_conn_dev;
>  
> -	ret = isert_rdma_accept(isert_conn);
> +	ret = isert_rdma_accept(isert_conn, cma_id);
>  	if (ret)
>  		goto out_conn_dev;
>  
> @@ -1452,7 +1452,7 @@
>  isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
>  {
>  	struct isert_conn *isert_conn = wc->qp->qp_context;
> -	struct ib_device *ib_dev = isert_conn->cm_id->device;
> +	struct ib_device *ib_dev = isert_conn->device->ib_device;
>  
>  	if (unlikely(wc->status != IB_WC_SUCCESS)) {
>  		isert_print_wc(wc, "login recv");
> @@ -1769,7 +1769,7 @@
>  isert_login_send_done(struct ib_cq *cq, struct ib_wc *wc)
>  {
>  	struct isert_conn *isert_conn = wc->qp->qp_context;
> -	struct ib_device *ib_dev = isert_conn->cm_id->device;
> +	struct ib_device *ib_dev = isert_conn->device->ib_device;
>  	struct iser_tx_desc *tx_desc = cqe_to_tx_desc(wc->wr_cqe);
>  
>  	if (unlikely(wc->status != IB_WC_SUCCESS)) {
> @@ -2369,9 +2369,8 @@ struct rdma_cm_id *
>  }
>  
>  static int
> -isert_rdma_accept(struct isert_conn *isert_conn)
> +isert_rdma_accept(struct isert_conn *isert_conn, struct rdma_cm_id *cm_id)
>  {
> -	struct rdma_cm_id *cm_id = isert_conn->cm_id;
>  	struct rdma_conn_param cp;
>  	int ret;
>  	struct iser_cm_hdr rsp_hdr;