Commit 160f3549 authored by Sagi Grimberg's avatar Sagi Grimberg Committed by Christoph Hellwig
Browse files

nvme-tcp: fix UAF when detecting digest errors 



We should also bail from the io_work loop when we set rd_enabled to true,
so we don't attempt to read data from the socket when the TCP stream is
already out-of-sync or corrupted.

Fixes: 3f2304f8 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: default avatarDaniel Wagner <dwagner@suse.de>
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarDaniel Wagner <dwagner@suse.de>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 6a02a61e

drivers/nvme/host/tcp.c

+1 −1
Original line number Diff line number Diff line
@@ -1229,7 +1229,7 @@ static void nvme_tcp_io_work(struct work_struct *w) 
		else if (unlikely(result < 0))

			return;



		if (!pending)

		if (!pending || !queue->rd_enabled)

			return;



	} while (!time_after(jiffies, deadline)); /* quota is exhausted */