Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ee440c83 authored by Sagi Grimberg's avatar Sagi Grimberg Committed by Greg Kroah-Hartman
Browse files

nvmet-rdma: fix possible bad dereference when freeing rsps 



[ Upstream commit 73964c1d07c054376f1b32a62548571795159148 ]

It is possible that the host connected and saw a cm established
event and started sending nvme capsules on the qp, however the
ctrl did not yet see an established event. This is why the
rsp_wait_list exists (for async handling of these cmds, we move
them to a pending list).

Furthermore, it is possible that the ctrl cm times out, resulting
in a connect-error cm event. in this case we hit a bad deref [1]
because in nvmet_rdma_free_rsps we assume that all the responses
are in the free list.

We are freeing the cmds array anyways, so don't even bother to
remove the rsp from the free_list. It is also guaranteed that we
are not racing anything when we are releasing the queue so no
other context accessing this array should be running.

[1]:
--
Workqueue: nvmet-free-wq nvmet_rdma_free_queue_work [nvmet_rdma]
[...]
pc : nvmet_rdma_free_rsps+0x78/0xb8 [nvmet_rdma]
lr : nvmet_rdma_free_queue_work+0x88/0x120 [nvmet_rdma]
 Call trace:
 nvmet_rdma_free_rsps+0x78/0xb8 [nvmet_rdma]
 nvmet_rdma_free_queue_work+0x88/0x120 [nvmet_rdma]
 process_one_work+0x1ec/0x4a0
 worker_thread+0x48/0x490
 kthread+0x158/0x160
 ret_from_fork+0x10/0x18
--

Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e378b767

drivers/nvme/target/rdma.c

+4 −12
Original line number Diff line number Diff line
@@ -428,12 +428,8 @@ nvmet_rdma_alloc_rsps(struct nvmet_rdma_queue *queue) 
	return 0;



out_free:

	while (--i >= 0) {

		struct nvmet_rdma_rsp *rsp = &queue->rsps[i];



		list_del(&rsp->free_list);

		nvmet_rdma_free_rsp(ndev, rsp);

	}

	while (--i >= 0)

		nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);

	kfree(queue->rsps);

out:

	return ret;
@@ -444,12 +440,8 @@ static void nvmet_rdma_free_rsps(struct nvmet_rdma_queue *queue) 
	struct nvmet_rdma_device *ndev = queue->dev;

	int i, nr_rsps = queue->recv_queue_size * 2;



	for (i = 0; i < nr_rsps; i++) {

		struct nvmet_rdma_rsp *rsp = &queue->rsps[i];



		list_del(&rsp->free_list);

		nvmet_rdma_free_rsp(ndev, rsp);

	}

	for (i = 0; i < nr_rsps; i++)

		nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);

	kfree(queue->rsps);

}