Patch "IB/iser: Fix possible bogus DMA unmapping" has been added to the 4.1-stable tree

Patch "IB/iser: Fix possible bogus DMA unmapping" has been added to the 4.1-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    IB/iser: Fix possible bogus DMA unmapping

to the 4.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ib-iser-fix-possible-bogus-dma-unmapping.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 8d5944d80359e645feb2ebd069a6f4caf7825e40 Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagig@mellanox.com>
Date: Thu, 6 Aug 2015 18:32:50 +0300
Subject: IB/iser: Fix possible bogus DMA unmapping

From: Sagi Grimberg <sagig@mellanox.com>

commit 8d5944d80359e645feb2ebd069a6f4caf7825e40 upstream.

If iser_initialize_task_headers() routine failed before
dma mapping, we should not attempt to unmap in cleanup_task().

Fixes: 7414dde0a6c3a958e (IB/iser: Fix race between iser connection ...)
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/ulp/iser/iscsi_iser.c |   12 ++++++++----
 drivers/infiniband/ulp/iser/iscsi_iser.h |    2 ++
 2 files changed, 10 insertions(+), 4 deletions(-)

--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -201,6 +201,7 @@ iser_initialize_task_headers(struct iscs
 		goto out;
 	}
 
+	tx_desc->mapped = true;
 	tx_desc->dma_addr = dma_addr;
 	tx_desc->tx_sg[0].addr   = tx_desc->dma_addr;
 	tx_desc->tx_sg[0].length = ISER_HEADERS_LEN;
@@ -360,16 +361,19 @@ iscsi_iser_task_xmit(struct iscsi_task *
 static void iscsi_iser_cleanup_task(struct iscsi_task *task)
 {
 	struct iscsi_iser_task *iser_task = task->dd_data;
-	struct iser_tx_desc    *tx_desc   = &iser_task->desc;
-	struct iser_conn       *iser_conn	  = task->conn->dd_data;
+	struct iser_tx_desc *tx_desc = &iser_task->desc;
+	struct iser_conn *iser_conn = task->conn->dd_data;
 	struct iser_device *device = iser_conn->ib_conn.device;
 
 	/* DEVICE_REMOVAL event might have already released the device */
 	if (!device)
 		return;
 
-	ib_dma_unmap_single(device->ib_device,
-		tx_desc->dma_addr, ISER_HEADERS_LEN, DMA_TO_DEVICE);
+	if (likely(tx_desc->mapped)) {
+		ib_dma_unmap_single(device->ib_device, tx_desc->dma_addr,
+				    ISER_HEADERS_LEN, DMA_TO_DEVICE);
+		tx_desc->mapped = false;
+	}
 
 	/* mgmt tasks do not need special cleanup */
 	if (!task->sc)
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -270,6 +270,7 @@ enum iser_desc_type {
  *                 sg[1] optionally points to either of immediate data
  *                 unsolicited data-out or control
  * @num_sge:       number sges used on this TX task
+ * @mapped:        Is the task header mapped
  */
 struct iser_tx_desc {
 	struct iser_hdr              iser_header;
@@ -278,6 +279,7 @@ struct iser_tx_desc {
 	u64		             dma_addr;
 	struct ib_sge		     tx_sg[2];
 	int                          num_sge;
+	bool			     mapped;
 };
 
 #define ISER_RX_PAD_SIZE	(256 - (ISER_RX_PAYLOAD_SIZE + \


Patches currently in stable-queue which might be from sagig@mellanox.com are

queue-4.1/ib-mlx4-fix-incorrect-cq-flushing-in-error-state.patch
queue-4.1/ib-mlx5-avoid-destroying-a-null-mr-in-reg_user_mr-error-flow.patch
queue-4.1/ib-iser-fix-missing-return-status-check-in-iser_send_data_out.patch
queue-4.1/ib-uverbs-reject-invalid-or-unknown-opcodes.patch
queue-4.1/ib-srp-stop-the-scsi_eh_-n-and-scsi_tmf_-n-threads-if-login-fails.patch
queue-4.1/ib-iser-fix-possible-bogus-dma-unmapping.patch
queue-4.1/ib-srp-handle-partial-connection-success-correctly.patch