Patch "iser-target: Fix possible use-after-free in connection establishment error" has been added to the 4.9-stable tree

Patch "iser-target: Fix possible use-after-free in connection establishment error" has been added to the 4.9-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    iser-target: Fix possible use-after-free in connection establishment error

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     iser-target-fix-possible-use-after-free-in-connection-establishment-error.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From cd52cb26e7ead5093635e98e07e221e4df482d34 Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@grimberg.me>
Date: Sun, 26 Nov 2017 15:31:04 +0200
Subject: iser-target: Fix possible use-after-free in connection establishment error

From: Sagi Grimberg <sagi@grimberg.me>

commit cd52cb26e7ead5093635e98e07e221e4df482d34 upstream.

In case we fail to establish the connection we must drain our pre-posted
login recieve work request before continuing safely with connection
teardown.

Fixes: a060b5629ab0 ("IB/core: generic RDMA READ/WRITE API")
Reported-by: Amrani, Ram <Ram.Amrani@cavium.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/ulp/isert/ib_isert.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -747,6 +747,7 @@ isert_connect_error(struct rdma_cm_id *c
 {
 	struct isert_conn *isert_conn = cma_id->qp->qp_context;
 
+	ib_drain_qp(isert_conn->qp);
 	list_del_init(&isert_conn->node);
 	isert_conn->cm_id = NULL;
 	isert_put_conn(isert_conn);


Patches currently in stable-queue which might be from sagi@grimberg.me are

queue-4.9/iser-target-fix-possible-use-after-free-in-connection-establishment-error.patch