Commit 5572a55a authored by Maurizio Lombardi's avatar Maurizio Lombardi Committed by Keith Busch
Browse files

nvmet-tcp: fix kernel crash if commands allocation fails 



If the commands allocation fails in nvmet_tcp_alloc_cmds()
the kernel crashes in nvmet_tcp_release_queue_work() because of
a NULL pointer dereference.

  nvmet: failed to install queue 0 cntlid 1 ret 6
  Unable to handle kernel NULL pointer dereference at
         virtual address 0000000000000008

Fix the bug by setting queue->nr_cmds to zero in case
nvmet_tcp_alloc_cmd() fails.

Fixes: 872d26a3 ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: default avatarMaurizio Lombardi <mlombard@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent 5a6d3a63

drivers/nvme/target/tcp.c

+3 −1
Original line number Diff line number Diff line
@@ -2146,8 +2146,10 @@ static u16 nvmet_tcp_install_queue(struct nvmet_sq *sq) 
	}



	queue->nr_cmds = sq->size * 2;

	if (nvmet_tcp_alloc_cmds(queue))

	if (nvmet_tcp_alloc_cmds(queue)) {

		queue->nr_cmds = 0;

		return NVME_SC_INTERNAL;

	}

	return 0;

}