[PATCH v2 0/2] RDMA/srp: fix use-after-free of a request in srp_destroy_qp()

[Yehyeong Lee]

Bart asked whether reordering srp_remove_target() also fixes the crash.
It does.  Against the same test target, the report appears in 5 of 5
runs without his patch and in 0 of 5 with it.  The drain still finds
the same two completions; the request pool now outlives it.  A
conforming target was unchanged over 5 runs each way.  Both patches
applied together behave the same way.  I never reached the SCSI error
handler.

Each patch stops the crash on its own, so this series carries both.
Patch 1 takes the shared ib_cqe out of the request; it is tagged for
stable.  Patch 2 is Bart's, carried as posted.  Whether it should go to
stable too is his call.

Two notes on patch 2, from source only.  srp_stop_rport_timers() is
documented as "Must be called after srp_remove_host() and
scsi_remove_host()" (scsi_transport_srp.c:789); patch 2 calls it before
both.  And the host now stays SHOST_RUNNING until the end, so a device
added by a late scan would miss the cache sync.  Its commands fail with
DID_NO_CONNECT, so that is a lost sync, not a crash.

v1: https://lore.kernel.org/linux-rdma/20260812190418.200337-1-yhlee@xxxxxxxxxxxxxxxxxx/

Bart Van Assche (1):
  RDMA/srp: Fix srp_remove_target()

Yehyeong Lee (1):
  RDMA/srp: fix use-after-free of a request in srp_destroy_qp()

 drivers/infiniband/ulp/srp/ib_srp.c | 30 +++++++++++++++++------------
 drivers/infiniband/ulp/srp/ib_srp.h |  8 +++++++-
 2 files changed, 25 insertions(+), 13 deletions(-)

-- 
2.43.0