* [PATCH] nvme-tcp: Fix a NULL deref when receiving a 0-length r2t PDU
@ 2021-03-15 21:08 Sagi Grimberg
2021-03-18 4:35 ` Christoph Hellwig
0 siblings, 1 reply; 2+ messages in thread
From: Sagi Grimberg @ 2021-03-15 21:08 UTC (permalink / raw)
To: linux-nvme, Keith Busch, Christoph Hellwig, Chaitanya Kulkarni
When the controller sends us a 0-length r2t PDU we should not attempt
to try to set up a h2cdata PDU but rather conclude that this is a buggy
controller (forward progress is not possible) and simply fail it
immediately.
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: Belanger, Martin <Martin.Belanger@dell.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
---
drivers/nvme/host/tcp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 18749090b926..850816b8b077 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -568,6 +568,13 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
req->pdu_len = le32_to_cpu(pdu->r2t_length);
req->pdu_sent = 0;
+ if (unlikely(!req->pdu_len)) {
+ dev_err(queue->ctrl->ctrl.device,
+ "req %d r2t len is %u, probably a bug...\n",
+ rq->tag, req->pdu_len);
+ return -EPROTO;
+ }
+
if (unlikely(req->data_sent + req->pdu_len > req->data_len)) {
dev_err(queue->ctrl->ctrl.device,
"req %d r2t len %u exceeded data len %u (%zu sent)\n",
--
2.27.0
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] nvme-tcp: Fix a NULL deref when receiving a 0-length r2t PDU
2021-03-15 21:08 [PATCH] nvme-tcp: Fix a NULL deref when receiving a 0-length r2t PDU Sagi Grimberg
@ 2021-03-18 4:35 ` Christoph Hellwig
0 siblings, 0 replies; 2+ messages in thread
From: Christoph Hellwig @ 2021-03-18 4:35 UTC (permalink / raw)
To: Sagi Grimberg
Cc: linux-nvme, Keith Busch, Christoph Hellwig, Chaitanya Kulkarni
Applied to nvme-5.12.
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-03-18 4:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-15 21:08 [PATCH] nvme-tcp: Fix a NULL deref when receiving a 0-length r2t PDU Sagi Grimberg
2021-03-18 4:35 ` Christoph Hellwig
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.