Unverified Commit 3fcd03c9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!2688 nvmet-tcp: Fix a possible UAF in queue intialization setup 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/M42KLT4BTCXDRU6ZKUIZIHRIHF7QYM2Z/ 
 
https://gitee.com/src-openeuler/kernel/issues/I88DLS 
 
Link:https://gitee.com/openeuler/kernel/pulls/2688

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: default avatarYu Kuai <yukuai3@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 4fb36a02 ef848f65

drivers/nvme/target/tcp.c

+2 −5
Original line number Diff line number Diff line
@@ -336,6 +336,7 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) 


static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)

{

	queue->rcv_state = NVMET_TCP_RECV_ERR;

	if (status == -EPIPE || status == -ECONNRESET)

		kernel_sock_shutdown(queue->sock, SHUT_RDWR);

	else
@@ -882,15 +883,11 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) 
	iov.iov_len = sizeof(*icresp);

	ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);

	if (ret < 0)

		goto free_crypto;

		return ret; /* queue removal will cleanup */



	queue->state = NVMET_TCP_Q_LIVE;

	nvmet_prepare_receive_pdu(queue);

	return 0;

free_crypto:

	if (queue->hdr_digest || queue->data_digest)

		nvmet_tcp_free_crypto(queue);

	return ret;

}



static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,