Commit fd0823f4 authored by Sagi Grimberg's avatar Sagi Grimberg Committed by Christoph Hellwig
Browse files

nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU 



When the controller sends us a 0-length r2t PDU we should not attempt to
try to set up a h2cdata PDU but rather conclude that this is a buggy
controller (forward progress is not possible) and simply fail it
immediately.

Fixes: 3f2304f8 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: default avatarBelanger, Martin <Martin.Belanger@dell.com>
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent b94e8cd2

drivers/nvme/host/tcp.c

+7 −0
Original line number Diff line number Diff line
@@ -568,6 +568,13 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req, 
	req->pdu_len = le32_to_cpu(pdu->r2t_length);

	req->pdu_sent = 0;



	if (unlikely(!req->pdu_len)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d r2t len is %u, probably a bug...\n",

			rq->tag, req->pdu_len);

		return -EPROTO;

	}



	if (unlikely(req->data_sent + req->pdu_len > req->data_len)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d r2t len %u exceeded data len %u (%zu sent)\n",