Commit 0bf04c87 authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Christoph Hellwig
Browse files

nvme-tcp: sanitize request list handling 



Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of
any list, otherwise a malicious R2T PDU might inject a loop in request
list processing.

Signed-off-by: default avatarHannes Reinecke <hare@kernel.org>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent e7143706

drivers/nvme/host/tcp.c

+14 −1
Original line number Diff line number Diff line
@@ -452,7 +452,8 @@ nvme_tcp_fetch_request(struct nvme_tcp_queue *queue) 
			return NULL;

	}



	list_del(&req->entry);

	list_del_init(&req->entry);

	init_llist_node(&req->lentry);

	return req;

}
@@ -560,6 +561,8 @@ static int nvme_tcp_init_request(struct blk_mq_tag_set *set, 
	req->queue = queue;

	nvme_req(rq)->ctrl = &ctrl->ctrl;

	nvme_req(rq)->cmd = &pdu->cmd;

	init_llist_node(&req->lentry);

	INIT_LIST_HEAD(&req->entry);



	return 0;

}
@@ -764,6 +767,14 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue, 
		return -EPROTO;

	}



	if (llist_on_list(&req->lentry) ||

	    !list_empty(&req->entry)) {

		dev_err(queue->ctrl->ctrl.device,

			"req %d unexpected r2t while processing request\n",

			rq->tag);

		return -EPROTO;

	}



	req->pdu_len = 0;

	req->h2cdata_left = r2t_length;

	req->h2cdata_offset = r2t_offset;
@@ -2638,6 +2649,8 @@ static void nvme_tcp_submit_async_event(struct nvme_ctrl *arg) 
	ctrl->async_req.offset = 0;

	ctrl->async_req.curr_bio = NULL;

	ctrl->async_req.data_len = 0;

	init_llist_node(&ctrl->async_req.lentry);

	INIT_LIST_HEAD(&ctrl->async_req.entry);



	nvme_tcp_queue_request(&ctrl->async_req, true);

}