* [PATCH] nvme-tcp: fix possible crash in write_zeroes processing
@ 2020-03-23 22:06 Sagi Grimberg
2020-03-24 16:20 ` Keith Busch
0 siblings, 1 reply; 2+ messages in thread
From: Sagi Grimberg @ 2020-03-23 22:06 UTC (permalink / raw)
To: linux-nvme, Keith Busch, Christoph Hellwig, Chaitanya Kulkarni
We cannot look at blk_rq_payload_bytes without first checking
that the request has a mappable physical segments first (e.g.
blk_rq_nr_phys_segments(rq) != 0) and only then to take the
request payload bytes. This caused us to send a wrong sgl to
the target or even dereference a non-existing buffer in case
we actually got to the data send sequence (if it was in-capsule).
Reported-by: Tony Asleson <tasleson@redhat.com>
Suggested-by: Chaitanya Kulkarni <Chaitanya.Kulkarni@wdc.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
---
drivers/nvme/host/tcp.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 11e10fe1760f..b545a9e96327 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -177,16 +177,14 @@ static inline bool nvme_tcp_async_req(struct nvme_tcp_request *req)
static inline bool nvme_tcp_has_inline_data(struct nvme_tcp_request *req)
{
struct request *rq;
- unsigned int bytes;
if (unlikely(nvme_tcp_async_req(req)))
return false; /* async events don't have a request */
rq = blk_mq_rq_from_pdu(req);
- bytes = blk_rq_payload_bytes(rq);
- return rq_data_dir(rq) == WRITE && bytes &&
- bytes <= nvme_tcp_inline_data_size(req->queue);
+ return rq_data_dir(rq) == WRITE && req->data_len &&
+ req->data_len <= nvme_tcp_inline_data_size(req->queue);
}
static inline struct page *nvme_tcp_req_cur_page(struct nvme_tcp_request *req)
@@ -2182,7 +2180,9 @@ static blk_status_t nvme_tcp_map_data(struct nvme_tcp_queue *queue,
c->common.flags |= NVME_CMD_SGL_METABUF;
- if (rq_data_dir(rq) == WRITE && req->data_len &&
+ if (!blk_rq_nr_phys_segments(rq))
+ nvme_tcp_set_sg_null(c);
+ else if (rq_data_dir(rq) == WRITE &&
req->data_len <= nvme_tcp_inline_data_size(queue))
nvme_tcp_set_sg_inline(queue, c, req->data_len);
else
@@ -2209,7 +2209,8 @@ static blk_status_t nvme_tcp_setup_cmd_pdu(struct nvme_ns *ns,
req->data_sent = 0;
req->pdu_len = 0;
req->pdu_sent = 0;
- req->data_len = blk_rq_payload_bytes(rq);
+ req->data_len = blk_rq_nr_phys_segments(rq) ?
+ blk_rq_payload_bytes(rq) : 0;
req->curr_bio = rq->bio;
if (rq_data_dir(rq) == WRITE &&
--
2.20.1
_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] nvme-tcp: fix possible crash in write_zeroes processing
2020-03-23 22:06 [PATCH] nvme-tcp: fix possible crash in write_zeroes processing Sagi Grimberg
@ 2020-03-24 16:20 ` Keith Busch
0 siblings, 0 replies; 2+ messages in thread
From: Keith Busch @ 2020-03-24 16:20 UTC (permalink / raw)
To: Sagi Grimberg; +Cc: Chaitanya Kulkarni, Christoph Hellwig, linux-nvme
On Mon, Mar 23, 2020 at 03:06:30PM -0700, Sagi Grimberg wrote:
> We cannot look at blk_rq_payload_bytes without first checking
> that the request has a mappable physical segments first (e.g.
> blk_rq_nr_phys_segments(rq) != 0) and only then to take the
> request payload bytes. This caused us to send a wrong sgl to
> the target or even dereference a non-existing buffer in case
> we actually got to the data send sequence (if it was in-capsule).
>
> Reported-by: Tony Asleson <tasleson@redhat.com>
> Suggested-by: Chaitanya Kulkarni <Chaitanya.Kulkarni@wdc.com>
> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Applied for 5.6, thanks.
_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-24 16:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-23 22:06 [PATCH] nvme-tcp: fix possible crash in write_zeroes processing Sagi Grimberg
2020-03-24 16:20 ` Keith Busch
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).