Commit aeacfcef authored by Chris Leech's avatar Chris Leech Committed by Christoph Hellwig
Browse files

nvme-tcp: fence TCP socket on receive error 



Ensure that no further socket reads occur after a receive processing
error, either from io_work being re-scheduled or nvme_tcp_poll.

Failing to do so can result in unrecognised PDU payloads or TCP stream
garbage being processed as a C2H data PDU, and potentially start copying
the payload to an invalid destination after looking up a request using a
bogus command id.

Signed-off-by: default avatarChris Leech <cleech@redhat.com>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarJohn Meneghini <jmeneghi@redhat.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent c5a9abfa

drivers/nvme/host/tcp.c

+3 −0
Original line number Diff line number Diff line
@@ -876,6 +876,9 @@ static int nvme_tcp_recv_skb(read_descriptor_t *desc, struct sk_buff *skb, 
	size_t consumed = len;

	int result;



	if (unlikely(!queue->rd_enabled))

		return -EFAULT;



	while (len) {

		switch (nvme_tcp_recv_state(queue)) {

		case NVME_TCP_RECV_PDU: