aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSagi Grimberg <sagi@grimberg.me>2021-03-15 14:08:11 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2021-03-24 11:26:37 +0100
commitcf7d7728d8a5e6740febf58759b6ede8275cd88e (patch)
tree525fe4d1782d50de46ccfbb02de10b7b9715cce5
parent36a4f9164cf6be00414c0f3b23976edbbcdef1c7 (diff)
downloadlinux-yocto-cf7d7728d8a5e6740febf58759b6ede8275cd88e.tar.gz
linux-yocto-cf7d7728d8a5e6740febf58759b6ede8275cd88e.tar.bz2
linux-yocto-cf7d7728d8a5e6740febf58759b6ede8275cd88e.zip
nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU
commit fd0823f405090f9f410fc3e3ff7efb52e7b486fa upstream. When the controller sends us a 0-length r2t PDU we should not attempt to try to set up a h2cdata PDU but rather conclude that this is a buggy controller (forward progress is not possible) and simply fail it immediately. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Reported-by: Belanger, Martin <Martin.Belanger@dell.com> Signed-off-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/nvme/host/tcp.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 1b9341fe73f9..ac3503ea54c4 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -512,6 +512,13 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
req->pdu_len = le32_to_cpu(pdu->r2t_length);
req->pdu_sent = 0;
+ if (unlikely(!req->pdu_len)) {
+ dev_err(queue->ctrl->ctrl.device,
+ "req %d r2t len is %u, probably a bug...\n",
+ rq->tag, req->pdu_len);
+ return -EPROTO;
+ }
+
if (unlikely(req->data_sent + req->pdu_len > req->data_len)) {
dev_err(queue->ctrl->ctrl.device,
"req %d r2t len %u exceeded data len %u (%zu sent)\n",