From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f178.google.com (mail-vk1-f178.google.com [209.85.221.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A21521E097 for ; Wed, 15 Jul 2026 00:51:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784076677; cv=none; b=J5g4r8wS1KNu0q4yabF9YMPPsFN+0YhlIXB95dE5d6KCHrdNS+Dcx7cUdyPun1qjwoAiwtpJqdBzk3uyOEag7W8KdnsfurHnO+IPqrOkQLb3b8nqTX9CLFMywVW9BzpndVrl8pW+yBVbA1D7fzpgANjdyMH0p68jBimAXjWbAHA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784076677; c=relaxed/simple; bh=gKlfgRGNY/HInIOEEDkEKYAotr7XeQ38EU4e1Cqg4Hc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pTgpmc6arFlfnV2SnqYmKeMEIFdhLdx7NPOu/Ir0ocbV/cPsv3vf4514ip6I1aluY9lr/MXoR7UGeOUf+LwfNbQIcM3yC9Q0PfCP+PB5UZyb0GL0Fu2pdLt5E/q9s3wTmnYVz0/Kzvt+6Ymp3K8xmCOvcWvtlQiXX81e5p3AlQM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TPa7GA3V; arc=none smtp.client-ip=209.85.221.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TPa7GA3V" Received: by mail-vk1-f178.google.com with SMTP id 71dfb90a1353d-5bdb162ee53so889208e0c.2 for ; Tue, 14 Jul 2026 17:51:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784076671; x=1784681471; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=JPDFGbUcKjq0fLUsPvbs/BQdu6/FNunI8oqbYcrNDjI=; b=TPa7GA3VSov9WYWxZFUU9YN0J7OS3M7rjTKv2NJGFUN0/0MtutlC/Gre9RN4HylcW1 sLIk9Cw+h4iAGbaQ6XsEz/ACWueN95st4N75qiHLI9jY7bw3nHfSpHedjFqG7QQrbejW CRcbqHj+oAJyaash1ehgM2Cb18Do3ggOCwqIvVOPDKicJpg2lckHgBPWKj84qD8EudJg ZtlDDvq5CtmOkbpP21+lCYqo8H3kK99ssbvKUfl6faGkesFo2qZey1V3Bv07w53N+YRY 5V+jqpLTN2uxvR7Mh3KQbQd3HsDMEjaHj78xkJZ+P2JvHjTFS+gGDVJP0WyiJHn/iE80 iKRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784076671; x=1784681471; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JPDFGbUcKjq0fLUsPvbs/BQdu6/FNunI8oqbYcrNDjI=; b=c2NegJqC8QKD2C+b1mUpWhUEyUWHBBsh1qrqtEP2Zj0nX1SNPxntbSbk3F/oooxcWP SY+yEkSRh8BXL+qD8GLyT45rnAJeZlgE9G/rCxr3YMAh3sCt4Eysae3xk9zpm5uG8MMh KlX66d6kQMCzgHeRSHCkJTqN13BsmCIKrmI8lagdrAGCxgKKPg4scLVkyljhV1uZNj4b CNV3wdIQeWEbXptSHMdd1hzeQY6RYdO5CoEMXWIa3lZrFTsrGz2/rnAbT3OdZNUW8EnG gomVLSX/BuRcv5YTfwNJmoUO13OIW+3588rbR4VplWw05UKHbjMg3wmArzBhJuf9Cxqt jgFw== X-Forwarded-Encrypted: i=1; AHgh+RrfSmtkuJZYjHipX8hj02R+9QO8YjKyRvBTKqPyhIapHLvPh351MDqbRL+k4Lq220LhSAADGJxd8JuxdKA=@vger.kernel.org X-Gm-Message-State: AOJu0Ywhck/NNrUx/8TPxyV12Y6afYqJnj5bKg3eFqloIyyW29rU5BfN bEr9oGlclk8qXWPD6mGq1qJXCezWt26b1WaojI/TEsX3tDr3aP5mcXC1 X-Gm-Gg: AfdE7cmSdGHhMy+F3OThjlGXmKby1pXO5TY2K+HJw77SlM8u5nBQBna1Ha0HcTZAUcY yVaLZ6Z1OZch+Pi1fuJYFzJ9hQ7gF5HMHBHI/WpXD4ZBtSETzCWRk8/OWkg1gZ+oJQJRtXcP+vZ ZK4NwOmXzxDibJCPrMqBV4I+yQFuoNVWG43VUYMQABbZGuB0XPnoIZvw3zgGX8cvy2Xaxjx1CAr 6LnkqlTLZbm7VNim2PSKx4LIK/39Mg6clDwUEzbu/qzdeft7t4f/VV6c27cnO1EFoW1qpdxI28j 779r3Zbu3lzBbI9ZnDHuLkwXGrqkqXbGd58NI7monh+zpgDhKMRLa2JYuxSOq6fTtHc76Hq1rJf Et75kuNOGKsqEP20hGVsTN6qmXgf++QNYIgYOOgr2zGAQ7nxLkIXameFsX+ovwyMXVje7CmUW8z jYeGMJpsGxuMiuh/zuaNAzBFbn82x0Y3A= X-Received: by 2002:a05:6122:787:b0:5a5:3eea:4513 with SMTP id 71dfb90a1353d-5bfbf34947bmr8882689e0c.12.1784076671006; Tue, 14 Jul 2026 17:51:11 -0700 (PDT) Received: from syssplab.cs.fiu.edu (nat1.cs.fiu.edu. [131.94.134.89]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5bfd0b319cesm6149473e0c.11.2026.07.14.17.51.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 17:51:09 -0700 (PDT) From: Chao Shi To: Keith Busch , Jens Axboe , Christoph Hellwig , Sagi Grimberg Cc: linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, Sungwoo Kim , Dave Tian , Weidong Zhu , Chao Shi Subject: [PATCH v2] nvme: reject completions for requests that are not in flight Date: Tue, 14 Jul 2026 20:51:05 -0400 Message-ID: <20260715005105.1115958-1-coshi036@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit nvme_find_rq() resolves a device-supplied command id to a request with blk_mq_tag_to_rq(), which returns whatever request last used that tag - possibly one that is no longer in flight (freed, or never dispatched and thus with a NULL rq->mq_hctx). Commit e7006de6c238 ("nvme: code command_id with a genctr for use-after-free validation") guards against this, but its generation counter is only 4 bits wide and can be matched by a malfunctioning device replaying command ids. The driver then completes a request that is not outstanding, dereferencing a NULL rq->mq_hctx or double-completing a command: Oops: general protection fault ... KASAN: null-ptr-deref RIP: blk_mq_complete_request_remote+0xe5/0xa80 block/blk-mq.c:1319 nvme_handle_cqe drivers/nvme/host/pci.c:1418 [inline] nvme_poll_cq drivers/nvme/host/pci.c:1449 nvme_irq drivers/nvme/host/pci.c:1463 Require the request to be in flight before completing it. The check uses the request state, so it also covers controllers with NVME_QUIRK_SKIP_CID_GEN. Found by FuzzNvme. Acked-by: Sungwoo Kim Acked-by: Dave Tian Acked-by: Weidong Zhu Signed-off-by: Chao Shi --- Changes since v1: - Drop the "malicious device" framing; describe the trigger as a malfunctioning controller. Commit message only; the code is unchanged. v1: https://lore.kernel.org/linux-nvme/20260522153034.2168862-1-coshi036@gmail.com/ drivers/nvme/host/nvme.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h index 9a5f28c5103c..3a525c1dc818 100644 --- a/drivers/nvme/host/nvme.h +++ b/drivers/nvme/host/nvme.h @@ -615,6 +615,17 @@ static inline struct request *nvme_find_rq(struct blk_mq_tags *tags, tag); return NULL; } + /* + * blk_mq_tag_to_rq() returns whatever request last used this tag, which + * may no longer be in flight if the device reports a bogus command id. + * Completing it would deref a NULL rq->mq_hctx or double-complete a + * command; the 4-bit genctr below only narrows the window. + */ + if (unlikely(blk_mq_rq_state(rq) != MQ_RQ_IN_FLIGHT)) { + dev_err(nvme_req(rq)->ctrl->device, + "completion for request %#x not in flight\n", tag); + return NULL; + } if (unlikely(nvme_genctr_mask(nvme_req(rq)->genctr) != genctr)) { dev_err(nvme_req(rq)->ctrl->device, "request %#x genctr mismatch (got %#x expected %#x)\n", -- 2.43.0