Commit 1d3ef9c3 authored by Varun Prakash's avatar Varun Prakash Committed by Christoph Hellwig
Browse files

nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t() 



If maxh2cdata < r2t_length then driver will form multiple
H2CData PDUs, validate R2T PDU in nvme_tcp_handle_r2t() to
reuse nvme_tcp_setup_h2c_data_pdu().

Also set req->state to NVME_TCP_SEND_H2C_PDU in
nvme_tcp_setup_h2c_data_pdu().

Signed-off-by: default avatarVarun Prakash <varun@chelsio.com>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 102110ef

drivers/nvme/host/tcp.c

+24 −31
Original line number Diff line number Diff line
@@ -572,7 +572,7 @@ static int nvme_tcp_handle_comp(struct nvme_tcp_queue *queue, 
	return ret;

}



static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,

static void nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,

		struct nvme_tcp_r2t_pdu *pdu)

{

	struct nvme_tcp_data_pdu *data = req->pdu;
@@ -581,32 +581,11 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req, 
	u8 hdgst = nvme_tcp_hdgst_len(queue);

	u8 ddgst = nvme_tcp_ddgst_len(queue);



	req->state = NVME_TCP_SEND_H2C_PDU;

	req->offset = 0;

	req->pdu_len = le32_to_cpu(pdu->r2t_length);

	req->pdu_sent = 0;



	if (unlikely(!req->pdu_len)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d r2t len is %u, probably a bug...\n",

			rq->tag, req->pdu_len);

		return -EPROTO;

	}



	if (unlikely(req->data_sent + req->pdu_len > req->data_len)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d r2t len %u exceeded data len %u (%zu sent)\n",

			rq->tag, req->pdu_len, req->data_len,

			req->data_sent);

		return -EPROTO;

	}



	if (unlikely(le32_to_cpu(pdu->r2t_offset) < req->data_sent)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d unexpected r2t offset %u (expected %zu)\n",

			rq->tag, le32_to_cpu(pdu->r2t_offset),

			req->data_sent);

		return -EPROTO;

	}



	memset(data, 0, sizeof(*data));

	data->hdr.type = nvme_tcp_h2c_data;

	data->hdr.flags = NVME_TCP_F_DATA_LAST;
@@ -622,7 +601,6 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req, 
	data->command_id = nvme_cid(rq);

	data->data_offset = pdu->r2t_offset;

	data->data_length = cpu_to_le32(req->pdu_len);

	return 0;

}



static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue,
@@ -630,7 +608,7 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue, 
{

	struct nvme_tcp_request *req;

	struct request *rq;

	int ret;

	u32 r2t_length = le32_to_cpu(pdu->r2t_length);



	rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);

	if (!rq) {
@@ -641,13 +619,28 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue, 
	}

	req = blk_mq_rq_to_pdu(rq);



	ret = nvme_tcp_setup_h2c_data_pdu(req, pdu);

	if (unlikely(ret))

		return ret;

	if (unlikely(!r2t_length)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d r2t len is %u, probably a bug...\n",

			rq->tag, r2t_length);

		return -EPROTO;

	}



	req->state = NVME_TCP_SEND_H2C_PDU;

	req->offset = 0;

	if (unlikely(req->data_sent + r2t_length > req->data_len)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d r2t len %u exceeded data len %u (%zu sent)\n",

			rq->tag, r2t_length, req->data_len, req->data_sent);

		return -EPROTO;

	}



	if (unlikely(le32_to_cpu(pdu->r2t_offset) < req->data_sent)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d unexpected r2t offset %u (expected %zu)\n",

			rq->tag, le32_to_cpu(pdu->r2t_offset), req->data_sent);

		return -EPROTO;

	}



	nvme_tcp_setup_h2c_data_pdu(req, pdu);

	nvme_tcp_queue_request(req, false, true);



	return 0;