[PATCH] RDMA/iser: Unmap Data-Out header DMA on send failure

[PATCH] RDMA/iser: Unmap Data-Out header DMA on send failure

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

iser_send_data_out() maps the tx_desc header for DMA via
iser_initialize_task_headers() (which sets tx_desc->mapped and calls
ib_dma_map_single()).  The normal completion path hands unmap and free
off to the iser_dataout_comp() completion callback.

However, if a later step fails -- the bounds check
(buf_offset + data_seg_len > data_len) or iser_post_send() -- control
jumps to send_data_out_error, which only calls kmem_cache_free() without
ib_dma_unmap_single().  Because the WR was never posted, the completion
callback never fires to unmap it, so the DMA mapping is leaked.

Unmap the header DMA in the error path when tx_desc->mapped is set,
mirroring the pattern already used in iscsi_iser_cleanup_task().

Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/ulp/iser/iser_initiator.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 7ea6888..9685e0a 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -464,6 +464,10 @@ int iser_send_data_out(struct iscsi_conn *conn, struct iscsi_task *task,
 		return 0;
 
 send_data_out_error:
+	if (tx_desc->mapped)
+		ib_dma_unmap_single(iser_conn->ib_conn.device->ib_device,
+				    tx_desc->dma_addr, ISER_HEADERS_LEN,
+				    DMA_TO_DEVICE);
 	kmem_cache_free(ig.desc_cache, tx_desc);
 	iser_err("conn %p failed err %d\n", conn, err);
 	return err;
-- 
2.9.4

Re: [PATCH] RDMA/iser: Unmap Data-Out header DMA on send failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] iser: NULL pointer dereference in iser_send_data_out error path
--

commit 3d250519caf840438453e72597d8f3c0e0bcd912
Author: Li RongQing <lirongqing@baidu.com>

RDMA/iser: Unmap Data-Out header DMA on send failure

This commit fixes a DMA mapping leak in iser_send_data_out() by unmapping
the header DMA in the error path if the transmit descriptor was mapped.

> diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
> index 12a2d12fef070..1cdc8f389919f 100644
> --- a/drivers/infiniband/ulp/iser/iser_initiator.c
> +++ b/drivers/infiniband/ulp/iser/iser_initiator.c
> @@ -464,6 +464,10 @@ int iser_send_data_out(struct iscsi_conn *conn, struct iscsi_task *task,
>  		return 0;
>  
>  send_data_out_error:
> +	if (tx_desc->mapped)
> +		ib_dma_unmap_single(iser_conn->ib_conn.device->ib_device,

[Severity: High]
Can this result in a NULL pointer dereference if a DEVICE_REMOVAL CM event
occurs concurrently?

If a target sends a malformed R2T that fails the bounds check, execution jumps
to send_data_out_error. If a DEVICE_REMOVAL event occurs simultaneously,
the CM thread handles the removal asynchronously and sets
iser_conn->ib_conn.device = NULL.

Since iser_send_data_out() does not hold state_mutex or otherwise
synchronize with DEVICE_REMOVAL, iser_conn->ib_conn.device can be evaluated
as NULL here. 

The commit message mentions mirroring iscsi_iser_cleanup_task(), which uses a
safety check for this exact race. Does this new error path need a similar
check before dereferencing the device?

> +				    tx_desc->dma_addr, ISER_HEADERS_LEN,
> +				    DMA_TO_DEVICE);
>  	kmem_cache_free(ig.desc_cache, tx_desc);
>  	iser_err("conn %p failed err %d\n", conn, err);
>  	return err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921033949.1803-1-lirongqing@baidu.com?part=1