lkml.org 
[lkml]   [2020]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.9 27/35] nvme-rdma: handle unexpected nvme completion data length
    Date
    From: zhenwei pi <pizhenwei@bytedance.com>

    [ Upstream commit 25c1ca6ecaba3b751d3f7ff92d5cddff3b05f8d0 ]

    Receiving a zero length message leads to the following warnings because
    the CQE is processed twice:

    refcount_t: underflow; use-after-free.
    WARNING: CPU: 0 PID: 0 at lib/refcount.c:28

    RIP: 0010:refcount_warn_saturate+0xd9/0xe0
    Call Trace:
    <IRQ>
    nvme_rdma_recv_done+0xf3/0x280 [nvme_rdma]
    __ib_process_cq+0x76/0x150 [ib_core]
    ...

    Sanity check the received data length, to avoids this.

    Thanks to Chao Leng & Sagi for suggestions.

    Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/nvme/host/rdma.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
    index 9e378d0a0c01c..8c1c1ee0dabe1 100644
    --- a/drivers/nvme/host/rdma.c
    +++ b/drivers/nvme/host/rdma.c
    @@ -1767,6 +1767,14 @@ static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
    return;
    }

    + /* sanity checking for received data length */
    + if (unlikely(wc->byte_len < len)) {
    + dev_err(queue->ctrl->ctrl.device,
    + "Unexpected nvme completion length(%d)\n", wc->byte_len);
    + nvme_rdma_error_recovery(queue->ctrl);
    + return;
    + }
    +
    ib_dma_sync_single_for_cpu(ibdev, qe->dma, len, DMA_FROM_DEVICE);
    /*
    * AEN requests are special as they don't time out and can
    --
    2.27.0
    \
     
     \ /
      Last update: 2020-11-03 02:20    [W:2.368 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site