• Vladimir Neyelov's avatar
    IB/iser: Fix connection teardown race condition · c8c16d3b
    Vladimir Neyelov authored
    Under heavy iser target(scst) start/stop stress during login/logout
    on iser intitiator side happened trace call provided below.
    
    The function iscsi_iser_slave_alloc iser_conn pointer could be NULL,
    due to the fact that function iscsi_iser_conn_stop can be called before
    and free iser connection. Let's protect that flow by introducing global mutex.
    
    BUG: unable to handle kernel paging request at 0000000000001018
    IP: [<ffffffffc0426f7e>] iscsi_iser_slave_alloc+0x1e/0x50 [ib_iser]
    Call Trace:
    ? scsi_alloc_sdev+0x242/0x300
    scsi_probe_and_add_lun+0x9e1/0xea0
    ? kfree_const+0x21/0x30
    ? kobject_set_name_vargs+0x76/0x90
    ? __pm_runtime_resume+0x5b/0x70
    __scsi_scan_target+0xf6/0x250
    scsi_scan_target+0xea/0x100
    iscsi_user_scan_session.part.13+0x101/0x130 [scsi_transport_iscsi]
    ? iscsi_user_scan_session.part.13+0x130/0x130 [scsi_transport_iscsi]
    iscsi_user_scan_session+0x1e/0x30 [scsi_transport_iscsi]
    device_for_each_child+0x50/0x90
    iscsi_user_scan+0x44/0x60 [scsi_transport_iscsi]
    store_scan+0xa8/0x100
    ? common_file_perm+0x5d/0x1c0
    dev_attr_store+0x18/0x30
    sysfs_kf_write+0x37/0x40
    kernfs_fop_write+0x12c/0x1c0
    __vfs_write+0x18/0x40
    vfs_write+0xb5/0x1a0
    SyS_write+0x55/0xc0
    
    Fixes: 318d311e ("iser: Accept arbitrary sg lists mapping if the device supports it")
    Cc: <stable@vger.kernel.org> # v4.5+
    Signed-off-by: default avatarVladimir Neyelov <vladimirn@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
    Reviewed-by: default avatarSagi Grimberg <sagi@grimbeg.me>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    c8c16d3b
iscsi_iser.c 31.5 KB