Re: [PATCH] IB/isert: Don't share drop_cmd_list across concurrent connection teardowns

[sashiko-bot@kernel.org]

> From: Li RongQing <lirongqing@baidu.com>
> 
> isert_put_unsol_pending_cmds() declares drop_cmd_list as a static
> LIST_HEAD, so the list is shared across all invocations of the function.
> It is called from isert_wait_conn(), the per-connection .iscsit_wait_conn
> transport callback, which runs independently for each connection during
> teardown.
> 
> conn->cmd_lock only protects each connection's own conn_cmd_list, not the
> shared drop_cmd_list.  If two connections tear down at the same time, both
> threads list_move_tail() commands into the same drop_cmd_list without any
> mutual exclusion, and then both iterate and list_del/put it concurrently.
> This corrupts the linked list and can double-free iscsit_cmd structures.
> 
> Make drop_cmd_list a stack-local list, matching the pattern already used
> in isert_free_np().
> 
> Fixes: 3e03c4b01da3 ("iser-target: Put the reference on commands waiting for unsol data")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921031100.2199-1-lirongqing@baidu.com?part=1