From 07bc4bb1af7f241a5bfa95e0e9bb7ca389b7a9c5 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Tue, 26 Apr 2016 14:13:13 +0000 Subject: [PATCH] isert: clean tmo timer when freeing the connection The tmo timer is set when allocating a new connection. We need to release it in case it didn't execute yet. Else timer execution will lead to a NULL dereference bug on conn. Signed-off-by: Israel Rukshin git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6878 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- iscsi-scst/kernel/isert-scst/iser_rdma.c | 7 +++++++ iscsi-scst/kernel/isert-scst/isert.h | 1 + iscsi-scst/kernel/isert-scst/isert_login.c | 2 +- 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/iscsi-scst/kernel/isert-scst/iser_rdma.c b/iscsi-scst/kernel/isert-scst/iser_rdma.c index 92f98fcb8..fe98696ec 100644 --- a/iscsi-scst/kernel/isert-scst/iser_rdma.c +++ b/iscsi-scst/kernel/isert-scst/iser_rdma.c @@ -42,6 +42,7 @@ #include "isert_dbg.h" #include "iser.h" +#include "isert.h" #include "iser_datamover.h" #define ISER_CQ_ENTRIES (128 * 1024) @@ -1255,6 +1256,7 @@ static void isert_deref_device(struct isert_device *isert_dev) static void isert_kref_free(struct kref *kref) { + struct isert_conn_dev *dev; struct isert_connection *isert_conn = container_of(kref, struct isert_connection, kref); @@ -1268,6 +1270,11 @@ static void isert_kref_free(struct kref *kref) isert_free_conn_resources(isert_conn); rdma_destroy_id(isert_conn->cm_id); + + dev = isert_get_priv(&isert_conn->iscsi); + if (dev) + isert_del_timer(dev); + ib_destroy_qp(isert_conn->qp); isert_conn->qp = NULL; diff --git a/iscsi-scst/kernel/isert-scst/isert.h b/iscsi-scst/kernel/isert-scst/isert.h index 8dde1a70a..0c5113edf 100644 --- a/iscsi-scst/kernel/isert-scst/isert.h +++ b/iscsi-scst/kernel/isert-scst/isert.h @@ -131,5 +131,6 @@ int isert_conn_alloc(struct iscsi_session *session, struct iscsit_transport *t); int isert_handle_close_connection(struct iscsi_conn *conn); void isert_close_all_portals(void); +void isert_del_timer(struct isert_conn_dev *dev); #endif /* __ISERT_H__ */ diff --git a/iscsi-scst/kernel/isert-scst/isert_login.c b/iscsi-scst/kernel/isert-scst/isert_login.c index 0a3720306..9d78bb1bc 100644 --- a/iscsi-scst/kernel/isert-scst/isert_login.c +++ b/iscsi-scst/kernel/isert-scst/isert_login.c @@ -83,7 +83,7 @@ static struct isert_conn_dev *get_available_dev(struct isert_listener_dev *dev, return res; } -static void isert_del_timer(struct isert_conn_dev *dev) +void isert_del_timer(struct isert_conn_dev *dev) { if (dev->timer_active) { dev->timer_active = 0;