[PATCH v7 0/6] IB/isert: fix the device removal use-after-free

[Yehyeong Lee]

The RDMA_CM_EVENT_DEVICE_REMOVAL callback in ib_isert waits for the
connection it was handed to reach ISER_CONN_DOWN and then frees it, a
use-after-free against isert_connect_release(), and the wait deadlocks
against the handler_mutex rdma_destroy_id() needs.  3/6 moves the teardown
into an ib_client callback, as nvmet-rdma did in f1d4ef7d8883, and gives
every connection one owner.  1/6 and 2/6 are older problems; 4/6, 5/6 and
6/6 close three holes the walk makes visible.

v6 -> v7

v6: https://lore.kernel.org/r/20261103223802.1697607-1-yhlee@xxxxxxxxxxxxxxxxxx

v5: https://lore.kernel.org/r/20261103125955.1530355-1-yhlee@xxxxxxxxxxxxxxxxxx

v4: https://lore.kernel.org/r/20261103032924.1073138-1-yhlee@xxxxxxxxxxxxxxxxxx

Sashiko v6 5/6 Medium: set removing in the same critical section that
clears the client data.  isert_remove_one() cleared the ib_client data and
took its device reference under device_list_mutex, and set the removing
flag only in a later section.  Between the two an isert_device_get() for
another device with the same node_guid still saw the departing device as
usable and raised its reference count.  5/6 now takes isert_conn_mutex
first and does the clear, the lookup, the reference, the completion and
the flag in one device_list_mutex section.  No path in the series holds
device_list_mutex while taking isert_conn_mutex.  Nothing else changed:
1/6 to 4/6 and 6/6 are the same commits as in v6.

Measured over soft-RoCE with KASAN.  Parking isert_remove_one() after its
lookup and connecting on a second device with the same node_guid gave the
departing device two more references on v6 in both runs and none on v7.
Everything else is unchanged from v6: 140 runs with no KASAN, no Oops, no
lockdep splat and no refcount warning on either side, the late-device
window building one device and no core warning in six of eighteen runs,
twenty link removals and re-adds leaving device_list empty, and the login
park finishing in eight seconds.  I still could not measure the namespace
move, for the reason given in v6.

Yehyeong Lee (6):
  IB/isert: do not publish connections being released on a second list
  IB/isert: drain the QP without holding isert_conn->mutex
  IB/isert: tear connections down from an ib_client on device removal
  IB/isert: drop the promotion reference when a connection errors out
  IB/isert: do not build a new isert_device for a device being removed
  IB/isert: only reinstate a connection that reached full feature phase

 drivers/infiniband/ulp/isert/ib_isert.c | 399 +++++++++++++++++-------
 drivers/infiniband/ulp/isert/ib_isert.h |   9 +-
 2 files changed, 297 insertions(+), 111 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0