Re: [PATCH net] nvme-tcp: Fix comma-related oops

Keith Busch
2023-06-30T15:20:49Z

On Thu, Jun 29, 2023 at 10:47:53PM +0100, David Howells wrote:
> Fix a comma that should be a semicolon. The comma is at the end of an
> if-body and thus makes the statement after (a bvec_set_page()) conditional
> too, resulting in an oops because we didn't fill out the bio_vec[]:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000008
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> ...
> Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp]
> RIP: 0010:skb_splice_from_iter+0xf1/0x370
> ...
> Call Trace:
> tcp_sendmsg_locked+0x3a6/0xdd0
> tcp_sendmsg+0x31/0x50
> inet_sendmsg+0x47/0x80
> sock_sendmsg+0x99/0xb0
> nvme_tcp_try_send_data+0x149/0x490 [nvme_tcp]
> nvme_tcp_try_send+0x1b7/0x300 [nvme_tcp]
> nvme_tcp_io_work+0x40/0xc0 [nvme_tcp]
> process_one_work+0x21c/0x430
> worker_thread+0x54/0x3e0
> kthread+0xf8/0x130
>
> Fixes: 7769887817c3 ("nvme-tcp: Use sendmsg(MSG_SPLICE_PAGES) rather then sendpage")

We don't have this breaking commit in the nvme tree just yet, so feel
free to take the fix through net if this can't wait for the next nvme
rebase (we're based on the block tree).