From: Keith Busch <kbusch@kernel.org>
To: Logan Gunthorpe <logang@deltatee.com>
Cc: linux-nvme@lists.infradead.org, sagi@grimberg.me,
Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>,
hch@lst.de
Subject: Re: [PATCH 1/2] nvmet: fix oops in nvmet_execute_passthru_cmd()
Date: Thu, 6 Aug 2020 09:26:02 -0700 [thread overview]
Message-ID: <20200806162602.GD3075319@dhcp-10-100-145-180.wdl.wdc.com> (raw)
In-Reply-To: <1f6a1c73-fd0e-d05d-3254-03d0592ac998@deltatee.com>
On Thu, Aug 06, 2020 at 10:12:24AM -0600, Logan Gunthorpe wrote:
> On 2020-08-06 9:42 a.m., Keith Busch wrote:
> > On Thu, Aug 06, 2020 at 12:31:50AM -0700, Chaitanya Kulkarni wrote:
> >> This patch adds a check in nvmet_execute_passthru_cmd() to prevent the
> >> following Oops :-
>
> It would be nice to have in the changelog what was done to trigger this
> oops.
>
> > Suggested changelog:
> >
> > A passthrough request may be NULL if an invalid namespace is used, or
> > if the allocation failed. Check for a valid request before releasing
> > it to fix a NULL pointer dereference.
>
> I don't think this is quite accurate either. It looks to me like it's
> just a bug in the error path logic. If the namespace is invalid, it
> doesn't even try to allocate the request so it should really just order
> the cleanup correctly and skip it, if it's not allocated.
>
> I think a fix like this would be cleaner:
Agree, this looks like a more appropriate way to unwind on failure.
> diff --git a/drivers/nvme/target/passthru.c b/drivers/nvme/target/passthru.c
> index a260c09b5ab2..96bc9aa11ddb 100644
> --- a/drivers/nvme/target/passthru.c
> +++ b/drivers/nvme/target/passthru.c
> @@ -239,7 +239,6 @@ static void nvmet_passthru_execute_cmd(struct
> nvmet_req *req)
>
> rq = nvme_alloc_request(q, req->cmd, BLK_MQ_REQ_NOWAIT, NVME_QID_ANY);
> if (IS_ERR(rq)) {
> - rq = NULL;
> status = NVME_SC_INTERNAL;
> goto fail_out;
> }
> @@ -248,7 +247,7 @@ static void nvmet_passthru_execute_cmd(struct
> nvmet_req *req)
> ret = nvmet_passthru_map_sg(req, rq);
> if (unlikely(ret)) {
> status = NVME_SC_INTERNAL;
> - goto fail_out;
> + goto fail_put_req;
> }
> }
>
> @@ -275,11 +274,12 @@ static void nvmet_passthru_execute_cmd(struct
> nvmet_req *req)
>
> return;
>
> +fail_put_req:
> + blk_put_request(rq);
> fail_out:
> if (ns)
> nvme_put_ns(ns);
> nvmet_req_complete(req, status);
> - blk_put_request(rq);
> }
>
> /*
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
next prev parent reply other threads:[~2020-08-06 16:26 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-06 7:31 [PATCH 0/2] nvmet: couple of passthru fixes Chaitanya Kulkarni
2020-08-06 7:31 ` [PATCH 1/2] nvmet: fix oops in nvmet_execute_passthru_cmd() Chaitanya Kulkarni
2020-08-06 15:42 ` Keith Busch
2020-08-06 16:12 ` Logan Gunthorpe
2020-08-06 16:26 ` Keith Busch [this message]
2020-08-06 19:40 ` Chaitanya Kulkarni
2020-08-06 19:45 ` Logan Gunthorpe
2020-08-06 19:54 ` Sagi Grimberg
2020-08-06 19:55 ` Logan Gunthorpe
2020-08-06 19:57 ` Chaitanya Kulkarni
2020-08-06 20:03 ` Sagi Grimberg
2020-08-06 20:06 ` Chaitanya Kulkarni
2020-08-06 19:55 ` Chaitanya Kulkarni
2020-08-06 19:18 ` Sagi Grimberg
2020-08-06 19:31 ` Chaitanya Kulkarni
2020-08-06 19:41 ` Sagi Grimberg
2020-08-06 19:44 ` Chaitanya Kulkarni
2020-08-06 19:29 ` Chaitanya Kulkarni
2020-08-06 7:31 ` [PATCH 2/2] nvmet: call blk_mq_free_request() directly Chaitanya Kulkarni
2020-08-06 15:45 ` Keith Busch
2020-08-06 16:14 ` Logan Gunthorpe
2020-08-06 19:19 ` Sagi Grimberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200806162602.GD3075319@dhcp-10-100-145-180.wdl.wdc.com \
--to=kbusch@kernel.org \
--cc=chaitanya.kulkarni@wdc.com \
--cc=hch@lst.de \
--cc=linux-nvme@lists.infradead.org \
--cc=logang@deltatee.com \
--cc=sagi@grimberg.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).