From: Varun Prakash <varun@chelsio.com>

Date: Tue, 26 Oct 2021 19:01:55 +0530

Subject: [PATCH] nvme-tcp: fix possible req->offset corruption

Git-commit: ce7723e9cdae4eb3030da082876580f4b2dc0861

Patch-mainline: v5.15-rc1

References: git-fixes

With commit db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq

context") r2t and response PDU can get processed while send function

is executing.

Current data digest send code uses req->offset after kernel_sendmsg(),

this creates a race condition where req->offset gets reset before it

is used in send function.

This can happen in two cases -

1. Target sends r2t PDU which resets req->offset.

2. Target send response PDU which completes the req and then req is

   used for a new command, nvme_tcp_setup_cmd_pdu() resets req->offset.

Fix this by storing req->offset in a local variable and using

this local variable after kernel_sendmsg().

Fixes: db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context")

Signed-off-by: Varun Prakash <varun@chelsio.com>

Reviewed-by: Keith Busch <kbusch@kernel.org>

Reviewed-by: Sagi Grimberg <sagi@grimberg.me>

Signed-off-by: Christoph Hellwig <hch@lst.de>

Acked-by: Hannes Reinecke <hare@suse.com>

---

 drivers/nvme/host/tcp.c | 3 ++-

 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c

index 0626d14e6d4c..1a209f0d7181 100644

--- a/drivers/nvme/host/tcp.c

+++ b/drivers/nvme/host/tcp.c

@@ -1050,6 +1050,7 @@ static int nvme_tcp_try_send_data_pdu(struct nvme_tcp_request *req)

 static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)

 {

 	struct nvme_tcp_queue *queue = req->queue;

+	size_t offset = req->offset;

 	int ret;

 	struct msghdr msg = { .msg_flags = MSG_DONTWAIT };

 	struct kvec iov = {

@@ -1066,7 +1067,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)

 	if (unlikely(ret <= 0))

 		return ret;

-	if (req->offset + ret == NVME_TCP_DIGEST_LENGTH) {

+	if (offset + ret == NVME_TCP_DIGEST_LENGTH) {

 		nvme_tcp_done_send_req(queue);

 		return 1;

 	}

-- 

2.29.2