lkml.org 
[lkml]   [2022]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 135/192] nvme-tcp: fix UAF when detecting digest errors
    Date
    From: Sagi Grimberg <sagi@grimberg.me>

    [ Upstream commit 160f3549a907a50e51a8518678ba2dcf2541abea ]

    We should also bail from the io_work loop when we set rd_enabled to true,
    so we don't attempt to read data from the socket when the TCP stream is
    already out-of-sync or corrupted.

    Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
    Reported-by: Daniel Wagner <dwagner@suse.de>
    Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
    Reviewed-by: Daniel Wagner <dwagner@suse.de>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/nvme/host/tcp.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
    index 7a9e6ffa23429..40bd68ba1040a 100644
    --- a/drivers/nvme/host/tcp.c
    +++ b/drivers/nvme/host/tcp.c
    @@ -1227,7 +1227,7 @@ static void nvme_tcp_io_work(struct work_struct *w)
    else if (unlikely(result < 0))
    return;

    - if (!pending)
    + if (!pending || !queue->rd_enabled)
    return;

    } while (!time_after(jiffies, deadline)); /* quota is exhausted */
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-09-13 16:28    [W:2.973 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site