On Sun, Jun 25, 2017 at 04:58:04PM -0700, Nicholas A. Bellinger wrote:
...
> So I assume isert_cma_handler() -> isert_connect_error() getting called
> to clear isert_conn->cm_id before connection established, and
> subsequently isert_conn->login_req_buf->rx_cqe.done() ->
> isert_login_recv_done() still getting invoked after connection failure
> is new RDMA API behavior..
>
> That said, following Sagi's original patch that added the clearing of
> isert_conn->cm_id to isert_connect_error(), it probably makes sense to
> use isert_conn->device->ib_device, and avoid dereferencing
> isert_conn->cm_id before connection is established.
>
> Here's a quick (untested) patch to do this for recv/send done callbacks,
> and avoid using isert_conn->cm_id during isert_rdma_accept().
>
> Sagi + Co, WDYT..?
Just tested this patch, I wasn't able to reproduce the NULL pointer
dereference or any other bugs, so this fix seems safe enough to me.
Tested-by: Andrea Righi <righi.and...@gmail.com>
>
> diff --git a/drivers/infiniband/ulp/isert/ib_isert.c
> b/drivers/infiniband/ulp/isert/ib_isert.c
> index fcbed35..f7f97f3 100644
> --- a/drivers/infiniband/ulp/isert/ib_isert.c
> +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> @@ -52,7 +52,7 @@
> static int
> isert_login_post_recv(struct isert_conn *isert_conn);
> static int
> -isert_rdma_accept(struct isert_conn *isert_conn);
> +isert_rdma_accept(struct isert_conn *isert_conn, struct rdma_cm_id *cm_id);
> struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
>
> static void isert_release_work(struct work_struct *work);
> @@ -543,7 +543,7 @@
> if (ret)
> goto out_conn_dev;
>
> - ret = isert_rdma_accept(isert_conn);
> + ret = isert_rdma_accept(isert_conn, cma_id);
> if (ret)
> goto out_conn_dev;
>
> @@ -1452,7 +1452,7 @@
> isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
> {
> struct isert_conn *isert_conn = wc->qp->qp_context;
> - struct ib_device *ib_dev = isert_conn->cm_id->device;
> + struct ib_device *ib_dev = isert_conn->device->ib_device;
>
> if (unlikely(wc->status != IB_WC_SUCCESS)) {
> isert_print_wc(wc, "login recv");
> @@ -1769,7 +1769,7 @@
> isert_login_send_done(struct ib_cq *cq, struct ib_wc *wc)
> {
> struct isert_conn *isert_conn = wc->qp->qp_context;
> - struct ib_device *ib_dev = isert_conn->cm_id->device;
> + struct ib_device *ib_dev = isert_conn->device->ib_device;
> struct iser_tx_desc *tx_desc = cqe_to_tx_desc(wc->wr_cqe);
>
> if (unlikely(wc->status != IB_WC_SUCCESS)) {
> @@ -2369,9 +2369,8 @@ struct rdma_cm_id *
> }
>
> static int
> -isert_rdma_accept(struct isert_conn *isert_conn)
> +isert_rdma_accept(struct isert_conn *isert_conn, struct rdma_cm_id *cm_id)
> {
> - struct rdma_cm_id *cm_id = isert_conn->cm_id;
> struct rdma_conn_param cp;
> int ret;
> struct iser_cm_hdr rsp_hdr;
