* [PATCH V2] nvmet-tcp: fix kernel crash if commands allocation fails
@ 2024-08-21 14:28 Maurizio Lombardi
2024-08-22 6:51 ` Christoph Hellwig
2024-08-26 21:39 ` Keith Busch
0 siblings, 2 replies; 3+ messages in thread
From: Maurizio Lombardi @ 2024-08-21 14:28 UTC (permalink / raw)
To: sagi; +Cc: axboe, hch, kch, linux-nvme, me
If the commands allocation fails in nvmet_tcp_alloc_cmds()
the kernel crashes in nvmet_tcp_release_queue_work() because of
a NULL pointer dereference.
nvmet: failed to install queue 0 cntlid 1 ret 6
Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000008
Fix the bug by setting queue->nr_cmds to zero in case
nvmet_tcp_alloc_cmd() fails.
Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
---
V2: add the Fixes tag
drivers/nvme/target/tcp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 5bff0d5464d1..7c51c2a8c109 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -2146,8 +2146,10 @@ static u16 nvmet_tcp_install_queue(struct nvmet_sq *sq)
}
queue->nr_cmds = sq->size * 2;
- if (nvmet_tcp_alloc_cmds(queue))
+ if (nvmet_tcp_alloc_cmds(queue)) {
+ queue->nr_cmds = 0;
return NVME_SC_INTERNAL;
+ }
return 0;
}
--
2.43.5
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH V2] nvmet-tcp: fix kernel crash if commands allocation fails
2024-08-21 14:28 [PATCH V2] nvmet-tcp: fix kernel crash if commands allocation fails Maurizio Lombardi
@ 2024-08-22 6:51 ` Christoph Hellwig
2024-08-26 21:39 ` Keith Busch
1 sibling, 0 replies; 3+ messages in thread
From: Christoph Hellwig @ 2024-08-22 6:51 UTC (permalink / raw)
To: Maurizio Lombardi; +Cc: sagi, axboe, hch, kch, linux-nvme, me
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH V2] nvmet-tcp: fix kernel crash if commands allocation fails
2024-08-21 14:28 [PATCH V2] nvmet-tcp: fix kernel crash if commands allocation fails Maurizio Lombardi
2024-08-22 6:51 ` Christoph Hellwig
@ 2024-08-26 21:39 ` Keith Busch
1 sibling, 0 replies; 3+ messages in thread
From: Keith Busch @ 2024-08-26 21:39 UTC (permalink / raw)
To: Maurizio Lombardi; +Cc: sagi, axboe, hch, kch, linux-nvme, me
On Wed, Aug 21, 2024 at 04:28:26PM +0200, Maurizio Lombardi wrote:
> If the commands allocation fails in nvmet_tcp_alloc_cmds()
> the kernel crashes in nvmet_tcp_release_queue_work() because of
> a NULL pointer dereference.
>
> nvmet: failed to install queue 0 cntlid 1 ret 6
> Unable to handle kernel NULL pointer dereference at
> virtual address 0000000000000008
>
> Fix the bug by setting queue->nr_cmds to zero in case
> nvmet_tcp_alloc_cmd() fails.
Thanks, applied to nvme-6.11.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-08-26 21:44 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-21 14:28 [PATCH V2] nvmet-tcp: fix kernel crash if commands allocation fails Maurizio Lombardi
2024-08-22 6:51 ` Christoph Hellwig
2024-08-26 21:39 ` Keith Busch
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox