[PATCH] IB/isert: Don't share drop_cmd_list across concurrent connection teardowns

[PATCH] IB/isert: Don't share drop_cmd_list across concurrent connection teardowns

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

isert_put_unsol_pending_cmds() declares drop_cmd_list as a static
LIST_HEAD, so the list is shared across all invocations of the function.
It is called from isert_wait_conn(), the per-connection .iscsit_wait_conn
transport callback, which runs independently for each connection during
teardown.

conn->cmd_lock only protects each connection's own conn_cmd_list, not the
shared drop_cmd_list.  If two connections tear down at the same time, both
threads list_move_tail() commands into the same drop_cmd_list without any
mutual exclusion, and then both iterate and list_del/put it concurrently.
This corrupts the linked list and can double-free iscsit_cmd structures.

Make drop_cmd_list a stack-local list, matching the pattern already used
in isert_free_np().

Fixes: 3e03c4b01da3 ("iser-target: Put the reference on commands waiting for unsol data")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/ulp/isert/ib_isert.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index e69db43..efa8d7b 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -2583,7 +2583,7 @@ static void
 isert_put_unsol_pending_cmds(struct iscsit_conn *conn)
 {
 	struct iscsit_cmd *cmd, *tmp;
-	static LIST_HEAD(drop_cmd_list);
+	LIST_HEAD(drop_cmd_list);
 
 	spin_lock_bh(&conn->cmd_lock);
 	list_for_each_entry_safe(cmd, tmp, &conn->conn_cmd_list, i_conn_node) {
-- 
2.9.4

Re: [PATCH] IB/isert: Don't share drop_cmd_list across concurrent connection teardowns

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> isert_put_unsol_pending_cmds() declares drop_cmd_list as a static
> LIST_HEAD, so the list is shared across all invocations of the function.
> It is called from isert_wait_conn(), the per-connection .iscsit_wait_conn
> transport callback, which runs independently for each connection during
> teardown.
> 
> conn->cmd_lock only protects each connection's own conn_cmd_list, not the
> shared drop_cmd_list.  If two connections tear down at the same time, both
> threads list_move_tail() commands into the same drop_cmd_list without any
> mutual exclusion, and then both iterate and list_del/put it concurrently.
> This corrupts the linked list and can double-free iscsit_cmd structures.
> 
> Make drop_cmd_list a stack-local list, matching the pattern already used
> in isert_free_np().
> 
> Fixes: 3e03c4b01da3 ("iser-target: Put the reference on commands waiting for unsol data")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921031100.2199-1-lirongqing@baidu.com?part=1

Re: [PATCH] IB/isert: Don't share drop_cmd_list across concurrent connection teardowns

[Leon Romanovsky]

On Mon, 21 Sep 2026 11:11:00 +0800, lirongqing wrote:
> isert_put_unsol_pending_cmds() declares drop_cmd_list as a static
> LIST_HEAD, so the list is shared across all invocations of the function.
> It is called from isert_wait_conn(), the per-connection .iscsit_wait_conn
> transport callback, which runs independently for each connection during
> teardown.
> 
> conn->cmd_lock only protects each connection's own conn_cmd_list, not the
> shared drop_cmd_list.  If two connections tear down at the same time, both
> threads list_move_tail() commands into the same drop_cmd_list without any
> mutual exclusion, and then both iterate and list_del/put it concurrently.
> This corrupts the linked list and can double-free iscsit_cmd structures.
> 
> [...]

Applied, thanks!

[1/1] IB/isert: Don't share drop_cmd_list across concurrent connection teardowns
      https://git.kernel.org/rdma/rdma/c/d30e9b1bc47bd9

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>