A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU

Browse source 
commit fd0823f405090f9f410fc3e3ff7efb52e7b486fa upstream.

When the controller sends us a 0-length r2t PDU we should not attempt to
try to set up a h2cdata PDU but rather conclude that this is a buggy
controller (forward progress is not possible) and simply fail it
immediately.

Fixes: 3f2304f8c6 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: Belanger, Martin <Martin.Belanger@dell.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Sagi Grimberg 2021-03-15 14:08:11 -07:00 • committed by Greg Kroah-Hartman
commit cf7d7728d8
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
drivers/nvme/host/tcp.c
View file

@ -512,6 +512,13 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
req->pdu_len = le32_to_cpu(pdu->r2t_length);
req->pdu_sent = 0;
if (unlikely(!req->pdu_len)) {
dev_err(queue->ctrl->ctrl.device,
"req %d r2t len is %u, probably a bug...\n",
rq->tag, req->pdu_len);
return -EPROTO;
}
if (unlikely(req->data_sent + req->pdu_len > req->data_len)) {
dev_err(queue->ctrl->ctrl.device,
"req %d r2t len %u exceeded data len %u (%zu sent)\n",