Waiting for other threads to release an object using code like
"while (object->refcnt > 0) msleep(100)" without holding a reference
on 'object' is wrong because the memory object points at may be freed
before or while this loop is in progress. Hence introduce a global
portal object count and wait on that count instead of waiting for
the per-portal reference count to reach zero.
The use-after-free was introduced in r6952 ("isert: faster release
of isert_scst module").
See also https://sourceforge.net/p/scst/tickets/2/.
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@7184 d57e44dd-8a1f-0410-8b47-8ef2f437770f
To avoid rare cases when checking ISERT_CONNECTION_EST bit
may lead to kref leak, we now take the third refcount earlier
before calling to rdma_accept.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6951 d57e44dd-8a1f-0410-8b47-8ef2f437770f
1) The race can happen after unreachable event handler close isert connection
and calling to rdma_disconnect from another thread on illegal cm_id.
For example call rdma_disconnect from isert_portal_release function.
2) It is also possible to get ESTABLISHED RDMACM event while rdma_disconnect
is called from another thread.
In established event we need to check conn is not in
teardown flow by checking the connection state with a mutex.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6950 d57e44dd-8a1f-0410-8b47-8ef2f437770f
We must wait for both the send and recv cqs to flush all pending work
requests.
To make sure that the drain will be the last flush we post a second
drain work request on the recv queue.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6946 d57e44dd-8a1f-0410-8b47-8ef2f437770f
On login logout stress we can start a teardown flow before connection is
fully established.
In this case we have one less refcount on isert connection.
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6937 d57e44dd-8a1f-0410-8b47-8ef2f437770f
We were submitting work requests sometimes after the drain_wr,
so we would try to process flushes on something that is already
destroyed. This can be seen with very high login/logout load.
Signed-off-by: Yan Burman <yanb@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6428 d57e44dd-8a1f-0410-8b47-8ef2f437770f
In order to be able to support large block sizes (larger than 512K),
we allocate required structured in a lazy fashion. This way we both support
large block sizes (over 512K and even over 1M). We also lower memory footprint
when smaller block sizes are used.
Signed-off-by: Yan Burman <yanb@mellanox.com>
git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6418 d57e44dd-8a1f-0410-8b47-8ef2f437770f
Bart Van Assche
Israel Rukshin
Bart Van Assche