Patch "nvmet-rdma: fix possible bad dereference when freeing rsps" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    nvmet-rdma: fix possible bad dereference when freeing rsps

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nvmet-rdma-fix-possible-bad-dereference-when-freeing.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1cc2c07a3c3b446a964ebd2424dc435071e4fed2
Author: Sagi Grimberg <sagi@xxxxxxxxxxx>
Date:   Wed May 8 10:53:06 2024 +0300

    nvmet-rdma: fix possible bad dereference when freeing rsps
    
    [ Upstream commit 73964c1d07c054376f1b32a62548571795159148 ]
    
    It is possible that the host connected and saw a cm established
    event and started sending nvme capsules on the qp, however the
    ctrl did not yet see an established event. This is why the
    rsp_wait_list exists (for async handling of these cmds, we move
    them to a pending list).
    
    Furthermore, it is possible that the ctrl cm times out, resulting
    in a connect-error cm event. in this case we hit a bad deref [1]
    because in nvmet_rdma_free_rsps we assume that all the responses
    are in the free list.
    
    We are freeing the cmds array anyways, so don't even bother to
    remove the rsp from the free_list. It is also guaranteed that we
    are not racing anything when we are releasing the queue so no
    other context accessing this array should be running.
    
    [1]:
    --
    Workqueue: nvmet-free-wq nvmet_rdma_free_queue_work [nvmet_rdma]
    [...]
    pc : nvmet_rdma_free_rsps+0x78/0xb8 [nvmet_rdma]
    lr : nvmet_rdma_free_queue_work+0x88/0x120 [nvmet_rdma]
     Call trace:
     nvmet_rdma_free_rsps+0x78/0xb8 [nvmet_rdma]
     nvmet_rdma_free_queue_work+0x88/0x120 [nvmet_rdma]
     process_one_work+0x1ec/0x4a0
     worker_thread+0x48/0x490
     kthread+0x158/0x160
     ret_from_fork+0x10/0x18
    --
    
    Signed-off-by: Sagi Grimberg <sagi@xxxxxxxxxxx>
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Keith Busch <kbusch@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 50e2007092bc0..ae41b6001c7e2 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -428,12 +428,8 @@ nvmet_rdma_alloc_rsps(struct nvmet_rdma_queue *queue)
 	return 0;
 
 out_free:
-	while (--i >= 0) {
-		struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
-
-		list_del(&rsp->free_list);
-		nvmet_rdma_free_rsp(ndev, rsp);
-	}
+	while (--i >= 0)
+		nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);
 	kfree(queue->rsps);
 out:
 	return ret;
@@ -444,12 +440,8 @@ static void nvmet_rdma_free_rsps(struct nvmet_rdma_queue *queue)
 	struct nvmet_rdma_device *ndev = queue->dev;
 	int i, nr_rsps = queue->recv_queue_size * 2;
 
-	for (i = 0; i < nr_rsps; i++) {
-		struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
-
-		list_del(&rsp->free_list);
-		nvmet_rdma_free_rsp(ndev, rsp);
-	}
+	for (i = 0; i < nr_rsps; i++)
+		nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);
 	kfree(queue->rsps);
 }