From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dmitry Bogdanov <d.bogdanov@yadro.com>,
Maurizio Lombardi <mlombard@redhat.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
linux@treblig.org, ebiggers@google.com, ardb@kernel.org,
viro@zeniv.linux.org.uk, linux-scsi@vger.kernel.org,
target-devel@vger.kernel.org
Subject: [PATCH AUTOSEL 6.1 01/10] scsi: target: iscsi: Fix timeout on deleted connection
Date: Tue, 29 Apr 2025 19:53:06 -0400 [thread overview]
Message-ID: <20250429235316.538129-1-sashal@kernel.org> (raw)
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
[ Upstream commit 7f533cc5ee4c4436cee51dc58e81dfd9c3384418 ]
NOPIN response timer may expire on a deleted connection and crash with
such logs:
Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d
BUG: Kernel NULL pointer dereference on read at 0x00000000
NIP strlcpy+0x8/0xb0
LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod]
Call Trace:
iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod]
call_timer_fn+0x58/0x1f0
run_timer_softirq+0x740/0x860
__do_softirq+0x16c/0x420
irq_exit+0x188/0x1c0
timer_interrupt+0x184/0x410
That is because nopin response timer may be re-started on nopin timer
expiration.
Stop nopin timer before stopping the nopin response timer to be sure
that no one of them will be re-started.
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Link: https://lore.kernel.org/r/20241224101757.32300-1-d.bogdanov@yadro.com
Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/iscsi/iscsi_target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 07e196b44b91d..04d40e76772b3 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4314,8 +4314,8 @@ int iscsit_close_connection(
spin_unlock(&iscsit_global->ts_bitmap_lock);
iscsit_stop_timers_for_cmds(conn);
- iscsit_stop_nopin_response_timer(conn);
iscsit_stop_nopin_timer(conn);
+ iscsit_stop_nopin_response_timer(conn);
if (conn->conn_transport->iscsit_wait_conn)
conn->conn_transport->iscsit_wait_conn(conn);
--
2.39.5
next reply other threads:[~2025-04-29 23:53 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-29 23:53 Sasha Levin [this message]
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 02/10] virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN Sasha Levin
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 03/10] dma-mapping: avoid potential unused data compilation warning Sasha Levin
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 04/10] cgroup: Fix compilation issue due to cgroup_mutex not being exported Sasha Levin
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 05/10] scsi: mpi3mr: Add level check to control event logging Sasha Levin
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 06/10] net: enetc: refactor bulk flipping of RX buffers to separate function Sasha Levin
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 07/10] drm/amdgpu: Allow P2P access through XGMI Sasha Levin
2025-04-30 12:57 ` Alex Deucher
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 08/10] selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure Sasha Levin
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 09/10] bpf: fix possible endless loop in BPF map iteration Sasha Levin
2025-04-29 23:53 ` [PATCH AUTOSEL 6.1 10/10] samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250429235316.538129-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ardb@kernel.org \
--cc=d.bogdanov@yadro.com \
--cc=ebiggers@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=linux@treblig.org \
--cc=martin.petersen@oracle.com \
--cc=mlombard@redhat.com \
--cc=stable@vger.kernel.org \
--cc=target-devel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox