[PATCH] nvme-tcp: Fix UAF when detecting digest errors

[PATCH] nvme-tcp: Fix UAF when detecting digest errors

[Sagi Grimberg]

We should also bail from the io_work loop when we
set rd_enabled to true, so we don't attempt to read
data from the socket when the tcp stream is already
out-of-sync or corrupted.

Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
---
 drivers/nvme/host/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 044da18c06f5..54b4e8a7fe42 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1229,7 +1229,7 @@ static void nvme_tcp_io_work(struct work_struct *w)
 		else if (unlikely(result < 0))
 			return;
 
-		if (!pending)
+		if (!pending || !queue->rd_enabled)
 			return;
 
 	} while (!time_after(jiffies, deadline)); /* quota is exhausted */
-- 
2.34.1

Re: [PATCH] nvme-tcp: Fix UAF when detecting digest errors

[Daniel Wagner]

On Mon, Sep 05, 2022 at 01:54:17PM +0300, Sagi Grimberg wrote:
> We should also bail from the io_work loop when we
> set rd_enabled to true, so we don't attempt to read
> data from the socket when the tcp stream is already
> out-of-sync or corrupted.
> 
> Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
> Reported-by: Daniel Wagner <dwagner@suse.de>
> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>

Makes sense independent of my bug report. I let you know what the
outcome of our customers testing is.

Reviewed-by: Daniel Wagner <dwagner@suse.de>

Re: [PATCH] nvme-tcp: Fix UAF when detecting digest errors

[Christoph Hellwig]

Thanks,

applied to nvme-6.0.

Re: [PATCH] nvme-tcp: Fix UAF when detecting digest errors

[Daniel Wagner]

Hi Sagi,

On Mon, Sep 05, 2022 at 02:04:21PM +0200, Daniel Wagner wrote:
> On Mon, Sep 05, 2022 at 01:54:17PM +0300, Sagi Grimberg wrote:
> > We should also bail from the io_work loop when we
> > set rd_enabled to true, so we don't attempt to read
> > data from the socket when the tcp stream is already
> > out-of-sync or corrupted.
> > 
> > Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
> > Reported-by: Daniel Wagner <dwagner@suse.de>
> > Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
> 
> Makes sense independent of my bug report. I let you know what the
> outcome of our customers testing is.

Finally got feedback on this patch. It fixes the reported problem. The
host doesn't crash anymore:

  nvme nvme10: data digest error: recv 0x0 expected 0x7b844ccf
  nvme nvme10: data digest error: recv 0x0 expected 0x7b844ccf
  nvme nvme10: data digest error: recv 0x0 expected 0x7b844ccf
  nvme nvme10: data digest error: recv 0x0 expected 0xee74c89b
  nvme nvme10: data digest error: recv 0x0 expected 0xee74c89b
  nvme nvme10: data digest error: recv 0x0 expected 0x7b844ccf

Thanks!
Daniel