Re: [PATCH] RDMA/iser: Unmap Data-Out header DMA on send failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] iser: NULL pointer dereference in iser_send_data_out error path
--

commit 3d250519caf840438453e72597d8f3c0e0bcd912
Author: Li RongQing <lirongqing@baidu.com>

RDMA/iser: Unmap Data-Out header DMA on send failure

This commit fixes a DMA mapping leak in iser_send_data_out() by unmapping
the header DMA in the error path if the transmit descriptor was mapped.

> diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
> index 12a2d12fef070..1cdc8f389919f 100644
> --- a/drivers/infiniband/ulp/iser/iser_initiator.c
> +++ b/drivers/infiniband/ulp/iser/iser_initiator.c
> @@ -464,6 +464,10 @@ int iser_send_data_out(struct iscsi_conn *conn, struct iscsi_task *task,
>  		return 0;
>  
>  send_data_out_error:
> +	if (tx_desc->mapped)
> +		ib_dma_unmap_single(iser_conn->ib_conn.device->ib_device,

[Severity: High]
Can this result in a NULL pointer dereference if a DEVICE_REMOVAL CM event
occurs concurrently?

If a target sends a malformed R2T that fails the bounds check, execution jumps
to send_data_out_error. If a DEVICE_REMOVAL event occurs simultaneously,
the CM thread handles the removal asynchronously and sets
iser_conn->ib_conn.device = NULL.

Since iser_send_data_out() does not hold state_mutex or otherwise
synchronize with DEVICE_REMOVAL, iser_conn->ib_conn.device can be evaluated
as NULL here. 

The commit message mentions mirroring iscsi_iser_cleanup_task(), which uses a
safety check for this exact race. Does this new error path need a similar
check before dereferencing the device?

> +				    tx_desc->dma_addr, ISER_HEADERS_LEN,
> +				    DMA_TO_DEVICE);
>  	kmem_cache_free(ig.desc_cache, tx_desc);
>  	iser_err("conn %p failed err %d\n", conn, err);
>  	return err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921033949.1803-1-lirongqing@baidu.com?part=1