Commit 46e8a02e authored by Sagi Grimberg's avatar Sagi Grimberg Committed by Jialin Zhang
Browse files

nvme-tcp: fix UAF when detecting digest errors 

stable inclusion
from stable-v5.10.143
commit 5914fa32ef1b7766fea933f9eed94ac5c00aa7ff
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6D0U6

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5914fa32ef1b7766fea933f9eed94ac5c00aa7ff



--------------------------------

[ Upstream commit 160f3549 ]

We should also bail from the io_work loop when we set rd_enabled to true,
so we don't attempt to read data from the socket when the TCP stream is
already out-of-sync or corrupted.

Fixes: 3f2304f8 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: default avatarDaniel Wagner <dwagner@suse.de>
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarDaniel Wagner <dwagner@suse.de>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent b419b65f

drivers/nvme/host/tcp.c

+1 −1
Original line number Diff line number Diff line
@@ -1196,7 +1196,7 @@ static void nvme_tcp_io_work(struct work_struct *w) 
		else if (unlikely(result < 0))

			return;



		if (!pending)

		if (!pending || !queue->rd_enabled)

			return;



	} while (!time_after(jiffies, deadline)); /* quota is exhausted */