diff options
| author | Sagi Grimberg <sagi@grimberg.me> | 2022-09-05 13:54:17 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-09-15 11:30:06 +0200 |
| commit | 13c80a6c112467bab5e44d090767930555fc17a5 (patch) | |
| tree | 5f02c68afd9c39b558e4d31ee8688ec711b040fc | |
| parent | 8ddd001cef5e82d19192e6861068463ecca5f556 (diff) | |
| download | linux-13c80a6c112467bab5e44d090767930555fc17a5.tar.gz linux-13c80a6c112467bab5e44d090767930555fc17a5.tar.bz2 linux-13c80a6c112467bab5e44d090767930555fc17a5.zip | |
nvme-tcp: fix UAF when detecting digest errors
[ Upstream commit 160f3549a907a50e51a8518678ba2dcf2541abea ]
We should also bail from the io_work loop when we set rd_enabled to true,
so we don't attempt to read data from the socket when the TCP stream is
already out-of-sync or corrupted.
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/nvme/host/tcp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 20138e132558..2c6e03113571 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -1209,7 +1209,7 @@ static void nvme_tcp_io_work(struct work_struct *w) else if (unlikely(result < 0)) return; - if (!pending) + if (!pending || !queue->rd_enabled) return; } while (!time_after(jiffies, deadline)); /* quota is exhausted */ |