This is a note to let you know that I've just added the patch titled
nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nvme-tcp-fix-a-null-deref-when-receiving-a-0-length-r2t-pdu.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From fd0823f405090f9f410fc3e3ff7efb52e7b486fa Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@xxxxxxxxxxx>
Date: Mon, 15 Mar 2021 14:08:11 -0700
Subject: nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU
From: Sagi Grimberg <sagi@xxxxxxxxxxx>
commit fd0823f405090f9f410fc3e3ff7efb52e7b486fa upstream.
When the controller sends us a 0-length r2t PDU we should not attempt to
try to set up a h2cdata PDU but rather conclude that this is a buggy
controller (forward progress is not possible) and simply fail it
immediately.
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: Belanger, Martin <Martin.Belanger@xxxxxxxx>
Signed-off-by: Sagi Grimberg <sagi@xxxxxxxxxxx>
Signed-off-by: Christoph Hellwig <hch@xxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/nvme/host/tcp.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -568,6 +568,13 @@ static int nvme_tcp_setup_h2c_data_pdu(s
req->pdu_len = le32_to_cpu(pdu->r2t_length);
req->pdu_sent = 0;
+ if (unlikely(!req->pdu_len)) {
+ dev_err(queue->ctrl->ctrl.device,
+ "req %d r2t len is %u, probably a bug...\n",
+ rq->tag, req->pdu_len);
+ return -EPROTO;
+ }
+
if (unlikely(req->data_sent + req->pdu_len > req->data_len)) {
dev_err(queue->ctrl->ctrl.device,
"req %d r2t len %u exceeded data len %u (%zu sent)\n",
Patches currently in stable-queue which might be from sagi@xxxxxxxxxxx are
queue-5.10/nvme-tcp-fix-a-null-deref-when-receiving-a-0-length-r2t-pdu.patch
queue-5.10/nvme-tcp-fix-possible-hang-when-failing-to-set-io-queues.patch
queue-5.10/nvme-tcp-fix-misuse-of-__smp_processor_id-with-preemption-enabled.patch
queue-5.10/nvmet-don-t-check-iosqes-iocqes-for-discovery-controllers.patch
