在 2024/3/29 19:59, Greg KH 写道:
On Wed, Mar 06, 2024 at 07:25:06PM +0800, Li Lingfeng wrote:
From: Li Lingfeng <lilingfeng3@xxxxxxxxxx>
A null-ptr-deref problem may occur since commit 706960d328f5 ("nvme: use
command_id instead of req->tag in trace_nvme_complete_rq()") tries to get
command_id by nvme_req(req)->cmd while nvme_req(req)->cmd is NULL.
The problem has been sloved since the patch has been reverted by commit
929ba86476b3. However, cmd->common.command_id is set to req->tag again
which should be ((genctl & 0xf)< 12 | req->tag).
Generating command_id by nvme_cid() in trace event instead of
nvme_req(req)->cmd->common.command_id to set it to
((genctl & 0xf)< 12 | req->tag) without trigging the null-ptr-deref
problem.
Fixes: commit 706960d328f5 ("nvme: use command_id instead of req->tag in trace_nvme_complete_rq()")
This committ is reverted in the 5.10.208 release, so is this change
still needed?
thanks,
greg k-h
As described by commit 706960d328f5 ("nvme: use command_id instead of
req->tag in trace_nvme_complete_rq()"), we should use command_id instead
of req->tag in trace_nvme_complete_rq(). So I don't think it's
appropriate to just revert it.
Replacing req->tag with nvme_cid(req) can solve the problem described by
commit 706960d328f5 without causing issues mentioned in commit
929ba86476b3 ("Revert "nvme: use command_id instead of req->tag in
trace_nvme_complete_rq()"").
Maybe fix tag should be changed to "Fixes: commit 929ba86476b3 ("Revert
"nvme: use command_id instead of req->tag in trace_nvme_complete_rq()"")"?
Thanks.
