Sending data over a queue pair after the corresponding cm_id has been destroyed is wrong. The HCA will send the data anyway and the data may be sent to another system to a queue pair that is in use. The data will get processed and a response will be sent back. An application will receive data that it did not expect. This can result in a kernel oops.
Cc: David Dillow <[email protected]> Cc: Roland Dreier <[email protected]> Signed-off-by: Bart Van Assche <[email protected]> --- drivers/infiniband/ulp/srp/ib_srp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 01b6cd7..abcefa1 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -1695,8 +1695,7 @@ static int srp_send_tsk_mgmt(struct srp_target_port *target, struct srp_iu *iu; struct srp_tsk_mgmt *tsk_mgmt; - if (target->state == SRP_TARGET_DEAD || - target->state == SRP_TARGET_REMOVED) + if (!target->connected) return -1; init_completion(&target->tsk_mgmt_done); -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
