3.19.8-ckt18 -stable review patch.  If anyone has any objections, please let me 
know.

---8<------------------------------------------------------------

From: Jenny Derzhavetz <jen...@mellanox.com>

commit aea92980601f7ddfcb3c54caa53a43726314fe46 upstream.

We need an indication that isert_conn->iscsi_conn binding has
happened so we'll know not to invoke a connection reinstatement
on an unbound connection which will lead to a bogus isert_conn->conn
dereferece.

Signed-off-by: Jenny Derzhavetz <jen...@mellanox.com>
Signed-off-by: Sagi Grimberg <sa...@mellanox.com>
Signed-off-by: Nicholas Bellinger <n...@linux-iscsi.org>
Signed-off-by: Kamal Mostafa <ka...@canonical.com>
---
 drivers/infiniband/ulp/isert/ib_isert.c | 7 +++++--
 drivers/infiniband/ulp/isert/ib_isert.h | 1 +
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c 
b/drivers/infiniband/ulp/isert/ib_isert.c
index 330e333..474dcd6 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -803,7 +803,7 @@ isert_put_conn(struct isert_conn *isert_conn)
  * @isert_conn: isert connection struct
  *
  * Notes:
- * In case the connection state is FULL_FEATURE, move state
+ * In case the connection state is BOUND, move state
  * to TEMINATING and start teardown sequence (rdma_disconnect).
  * In case the connection state is UP, complete flush as well.
  *
@@ -819,6 +819,7 @@ isert_conn_terminate(struct isert_conn *isert_conn)
        case ISER_CONN_TERMINATING:
                break;
        case ISER_CONN_UP:
+       case ISER_CONN_BOUND:
        case ISER_CONN_FULL_FEATURE: /* FALLTHRU */
                isert_info("Terminating conn %p state %d\n",
                           isert_conn, isert_conn->state);
@@ -2013,7 +2014,8 @@ isert_cq_comp_err(struct isert_conn *isert_conn, struct 
ib_wc *wc)
                        isert_completion_put(desc, isert_cmd, ib_dev, true);
        } else {
                isert_conn->post_recv_buf_count--;
-               if (!isert_conn->post_recv_buf_count)
+               if (!isert_conn->post_recv_buf_count &&
+                   isert_conn->state >= ISER_CONN_BOUND)
                        iscsit_cause_connection_reinstatement(isert_conn->conn, 
0);
        }
 }
@@ -3192,6 +3194,7 @@ accept_wait:
 
        conn->context = isert_conn;
        isert_conn->conn = conn;
+       isert_conn->state = ISER_CONN_BOUND;
        max_accept = 0;
 
        isert_set_conn_info(np, conn, isert_conn);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h 
b/drivers/infiniband/ulp/isert/ib_isert.h
index 8dc8415..1b48a10 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -51,6 +51,7 @@ enum iser_ib_op_code {
 enum iser_conn_state {
        ISER_CONN_INIT,
        ISER_CONN_UP,
+       ISER_CONN_BOUND,
        ISER_CONN_FULL_FEATURE,
        ISER_CONN_TERMINATING,
        ISER_CONN_DOWN,
-- 
2.7.4

Reply via email to