| From 5b5911b44629a306aae487f8fba310f2317845d3 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 25 Oct 2020 19:51:24 +0800 |
| Subject: nvme-rdma: handle unexpected nvme completion data length |
| |
| From: zhenwei pi <pizhenwei@bytedance.com> |
| |
| [ Upstream commit 25c1ca6ecaba3b751d3f7ff92d5cddff3b05f8d0 ] |
| |
| Receiving a zero length message leads to the following warnings because |
| the CQE is processed twice: |
| |
| refcount_t: underflow; use-after-free. |
| WARNING: CPU: 0 PID: 0 at lib/refcount.c:28 |
| |
| RIP: 0010:refcount_warn_saturate+0xd9/0xe0 |
| Call Trace: |
| <IRQ> |
| nvme_rdma_recv_done+0xf3/0x280 [nvme_rdma] |
| __ib_process_cq+0x76/0x150 [ib_core] |
| ... |
| |
| Sanity check the received data length, to avoids this. |
| |
| Thanks to Chao Leng & Sagi for suggestions. |
| |
| Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> |
| Reviewed-by: Sagi Grimberg <sagi@grimberg.me> |
| Signed-off-by: Christoph Hellwig <hch@lst.de> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/nvme/host/rdma.c | 8 ++++++++ |
| 1 file changed, 8 insertions(+) |
| |
| diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c |
| index 116902b1b2c34..3a598e91e816d 100644 |
| --- a/drivers/nvme/host/rdma.c |
| +++ b/drivers/nvme/host/rdma.c |
| @@ -1767,6 +1767,14 @@ static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) |
| return; |
| } |
| |
| + /* sanity checking for received data length */ |
| + if (unlikely(wc->byte_len < len)) { |
| + dev_err(queue->ctrl->ctrl.device, |
| + "Unexpected nvme completion length(%d)\n", wc->byte_len); |
| + nvme_rdma_error_recovery(queue->ctrl); |
| + return; |
| + } |
| + |
| ib_dma_sync_single_for_cpu(ibdev, qe->dma, len, DMA_FROM_DEVICE); |
| /* |
| * AEN requests are special as they don't time out and can |
| -- |
| 2.27.0 |
| |