Re: [PATCH v8 0/6] IB/isert: fix the device removal use-after-free

[Leon Romanovsky <leon@kernel.org>]

On Wed, Nov 04, 2026 at 01:03:11PM +0900, Yehyeong Lee wrote:
> The RDMA_CM_EVENT_DEVICE_REMOVAL callback in ib_isert waits for the
> connection it was handed to reach ISER_CONN_DOWN and then frees it, a
> use-after-free against isert_connect_release(), and the wait deadlocks
> against the handler_mutex rdma_destroy_id() needs.  3/6 moves the teardown
> into an ib_client callback, as nvmet-rdma did in f1d4ef7d8883, and gives
> every connection one owner.  1/6 and 2/6 are older problems; 4/6, 5/6 and
> 6/6 close three holes the walk makes visible.
> 
> v7 -> v8
> 
> v7: https://lore.kernel.org/r/20261104012219.1759523-1-yhlee@isslab.korea.ac.kr
> 
> v6: https://lore.kernel.org/r/20261103223802.1697607-1-yhlee@isslab.korea.ac.kr
> 
> v5: https://lore.kernel.org/r/20261103125955.1530355-1-yhlee@isslab.korea.ac.kr
> 
> v4: https://lore.kernel.org/r/20261103032924.1073138-1-yhlee@isslab.korea.ac.kr
> 
> Sashiko v7 3/6 High: isert_connect_error() clears cm_id after
> ib_drain_qp() again, as before the series.  Before the drain the QP can
> still take an event, and isert_qp_event_callback() dereferences cm_id.
> 
> Sashiko v7 5/6 High: isert_device_get() matches the ib_device pointer
> instead of node_guid, the same key isert_remove_one() uses.  Two devices
> can share a node_guid, and the PD and the DMA mappings belong to one of
> them.
> 
> Measured over soft-RoCE with KASAN, 114 runs.  A test-only event delivered
> to isert_qp_event_callback() before the drain oopsed in rdma_notify() nine
> times over two runs of 3/6 as it was in v7 and not once in two runs of
> this series.  A connect on a second device sharing a node_guid failed
> rdma_create_qp() twice in both runs before 5/6 and not at all after it.
> The cells v7 passed are unchanged: no KASAN, no Oops, no lockdep splat and
> no refcount warning on either side, device_list empty after twenty link
> removals and re-adds, and the login park finishing in eight seconds.  I
> still could not measure the namespace move, for the reason given in v6.
> 
> Yehyeong Lee (6):
>   IB/isert: do not publish connections being released on a second list
>   IB/isert: drain the QP without holding isert_conn->mutex
>   IB/isert: tear connections down from an ib_client on device removal
>   IB/isert: drop the promotion reference when a connection errors out
>   IB/isert: do not build a new isert_device for a device being removed
>   IB/isert: only reinstate a connection that reached full feature phase
> 
>  drivers/infiniband/ulp/isert/ib_isert.c | 395 +++++++++++++++++-------
>  drivers/infiniband/ulp/isert/ib_isert.h |   9 +-
>  2 files changed, 294 insertions(+), 110 deletions(-)

So what do you expect from us now? You didn't bother to invest time into it,
by all these resubmissions, you clearly showed us that this is 100% AI work,
not reviewed, not tested, but marked for the stable@.

Thanks

> 
> 
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
> -- 
> 2.43.0
>