|
Hannes Reinecke |
37c3f6 |
From: Sagi Grimberg <sagi@grimberg.me>
|
|
Hannes Reinecke |
37c3f6 |
Date: Mon, 15 Mar 2021 14:08:11 -0700
|
|
Hannes Reinecke |
37c3f6 |
Subject: [PATCH] nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU
|
|
Hannes Reinecke |
37c3f6 |
Git-commit: fd0823f405090f9f410fc3e3ff7efb52e7b486fa
|
|
Hannes Reinecke |
37c3f6 |
Patch-mainline: v5.12-rc1
|
|
Hannes Reinecke |
37c3f6 |
References: git-fixes
|
|
Hannes Reinecke |
37c3f6 |
|
|
Hannes Reinecke |
37c3f6 |
When the controller sends us a 0-length r2t PDU we should not attempt to
|
|
Hannes Reinecke |
37c3f6 |
try to set up a h2cdata PDU but rather conclude that this is a buggy
|
|
Hannes Reinecke |
37c3f6 |
controller (forward progress is not possible) and simply fail it
|
|
Hannes Reinecke |
37c3f6 |
immediately.
|
|
Hannes Reinecke |
37c3f6 |
|
|
Hannes Reinecke |
37c3f6 |
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
|
|
Hannes Reinecke |
37c3f6 |
Reported-by: Belanger, Martin <Martin.Belanger@dell.com>
|
|
Hannes Reinecke |
37c3f6 |
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
|
|
Hannes Reinecke |
37c3f6 |
Signed-off-by: Christoph Hellwig <hch@lst.de>
|
|
Hannes Reinecke |
37c3f6 |
Acked-by: Hannes Reinecke <hare@suse.com>
|
|
Hannes Reinecke |
37c3f6 |
---
|
|
Hannes Reinecke |
37c3f6 |
drivers/nvme/host/tcp.c | 7 +++++++
|
|
Hannes Reinecke |
37c3f6 |
1 file changed, 7 insertions(+)
|
|
Hannes Reinecke |
37c3f6 |
|
|
Hannes Reinecke |
37c3f6 |
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
|
|
Hannes Reinecke |
37c3f6 |
index c535836e7065..5b23e1d52cb3 100644
|
|
Hannes Reinecke |
37c3f6 |
--- a/drivers/nvme/host/tcp.c
|
|
Hannes Reinecke |
37c3f6 |
+++ b/drivers/nvme/host/tcp.c
|
|
Hannes Reinecke |
37c3f6 |
@@ -568,6 +568,13 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
|
|
Hannes Reinecke |
37c3f6 |
req->pdu_len = le32_to_cpu(pdu->r2t_length);
|
|
Hannes Reinecke |
37c3f6 |
req->pdu_sent = 0;
|
|
Hannes Reinecke |
37c3f6 |
|
|
Hannes Reinecke |
37c3f6 |
+ if (unlikely(!req->pdu_len)) {
|
|
Hannes Reinecke |
37c3f6 |
+ dev_err(queue->ctrl->ctrl.device,
|
|
Hannes Reinecke |
37c3f6 |
+ "req %d r2t len is %u, probably a bug...\n",
|
|
Hannes Reinecke |
37c3f6 |
+ rq->tag, req->pdu_len);
|
|
Hannes Reinecke |
37c3f6 |
+ return -EPROTO;
|
|
Hannes Reinecke |
37c3f6 |
+ }
|
|
Hannes Reinecke |
37c3f6 |
+
|
|
Hannes Reinecke |
37c3f6 |
if (unlikely(req->data_sent + req->pdu_len > req->data_len)) {
|
|
Hannes Reinecke |
37c3f6 |
dev_err(queue->ctrl->ctrl.device,
|
|
Hannes Reinecke |
37c3f6 |
"req %d r2t len %u exceeded data len %u (%zu sent)\n",
|
|
Hannes Reinecke |
37c3f6 |
--
|
|
Hannes Reinecke |
37c3f6 |
2.29.2
|
|
Hannes Reinecke |
37c3f6 |
|