The ioctl events may arive after the isert connection has
started the teardown flow.
This scenario may occur on login logout stress.
It may lead to NULL derefrence bugs.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6940 d57e44dd-8a1f-0410-8b47-8ef2f437770f
On login logout stress we can start a teardown flow before connection is
fully established.
In this case we have one less refcount on isert connection.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6937 d57e44dd-8a1f-0410-8b47-8ef2f437770f
Clean pointers not to point to invalid memory.
- While conn is released set conn_dev->conn to null as conn is invalid now.
- While conn_dev is released set priv(conn) to null as conn_dev is invalid now.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6935 d57e44dd-8a1f-0410-8b47-8ef2f437770f
target_del() calls handle_iscsi_events() which may recursively call target_del().
The 1st target_del() may resume its execution after the target object was already freed.
Signed-off-by: Erez Zilber <erezzi.list@gmail.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6908 d57e44dd-8a1f-0410-8b47-8ef2f437770f
It is possible to get ESTABLISHED RDMACM event while the connection
is already started teardown flow (i.e. addr change).
At teardown the refcount is reduced to zero and we start releasing the
connection. In established event We need to check conn is not in teardown
flow by checking its ref count is not 0.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6879 d57e44dd-8a1f-0410-8b47-8ef2f437770f
The tmo timer is set when allocating a new connection.
We need to release it in case it didn't execute yet.
Else timer execution will lead to a NULL dereference bug on conn.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6878 d57e44dd-8a1f-0410-8b47-8ef2f437770f
There is a race between RDMACM event handler and isert_conn_free.
The event handler use the connection resources and isert_conn_free
destroy them.
This commit fix multiple NULL dereference bugs.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6877 d57e44dd-8a1f-0410-8b47-8ef2f437770f
A nop that is sent from the scst is treated as a fake request.
When a fake request is allocated we release it immediately,
so it's wrong to release it also on a completion error (isert_pdu_err).
This commit fix a NULL dereference bug when receiving completion with
error on this nop.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Signed-off-by: Ariel Nahum <arieln@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6876 d57e44dd-8a1f-0410-8b47-8ef2f437770f
1. Fix build of progs and mods targets, if iscsi_scst_itf_ver.h does not exist
2. Fix small race for parallel build of "all" target, when iscsi_scst_itf_ver.h
not yet built, when progs or mods target need it
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6861 d57e44dd-8a1f-0410-8b47-8ef2f437770f
Additionally, surround complex values with parentheses, declare static
char arrays const and change C++ comments into C comments.
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6849 d57e44dd-8a1f-0410-8b47-8ef2f437770f
The C language does not require to use an explicit cast when assigning
a void * pointer to a pointer of another type.
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6633 d57e44dd-8a1f-0410-8b47-8ef2f437770f
The get and put of resources from the tx_free commands pool was not
symmetric. Commands that are self issued by the target (e.g. nop outs)
didn't release their resources, although they acquired them earlier.
Signed-off-by: Ariel Nahum <arieln@mellanox.com>
Signed-off-by: Alex Lyakas <alex@zadarastorage.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6630 d57e44dd-8a1f-0410-8b47-8ef2f437770f
Code after BUG() is unreachable both with CONFIG_BUG=y and with
CONFIG_BUG=n. Hence remove such code. Detected by smatch.
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6600 d57e44dd-8a1f-0410-8b47-8ef2f437770f
In a state where the list isert_conn->tx_free_list is empty
(mostly under traffic), we might fail to receive a command from
the isert command pool. This will result in later null deref.
In this case, busy-wait until a command will be available (will
be freed by the receive context).
[2158233.952087] BUG: unable to handle kernel NULL pointer dereference at (null)
[2158233.956023] IP: [<ffffffffa04e14d0>] isert_pdu_send+0xc0/0x1f0 [isert_scst]
....
[2158233.956023] [<ffffffffa04d98c8>] ? isert_cmnd_alloc+0x78/0x110 [isert_scst]
[2158233.956023] [<ffffffffa045b5a0>] req_cmnd_release+0x50/0x130 [iscsi_scst]
[2158233.956023] [<ffffffffa04622cb>] iscsi_send_nop_in+0x19b/0x370 [iscsi_scst]
Signed-off-by: Ariel Nahum <arieln@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6554 d57e44dd-8a1f-0410-8b47-8ef2f437770f
Israel Rukshin
Vladislav Bolkhovitin
Bart Van Assche