Commit cd9aed60 authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Keith Busch
Browse files

nvme: catch errors from nvme_configure_metadata() 



nvme_configure_metadata() is issuing I/O, so we might incur an I/O
error which will cause the connection to be reset.
But in that case any further probing will race with reset and
cause UAF errors.
So return a status from nvme_configure_metadata() and abort
probing if there was an I/O error.

Signed-off-by: default avatarHannes Reinecke <hare@suse.de>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent 23441536

drivers/nvme/host/core.c

+13 −6
Original line number Diff line number Diff line
@@ -1814,16 +1814,18 @@ static int nvme_init_ms(struct nvme_ns *ns, struct nvme_id_ns *id) 
	return ret;

}



static void nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id)

static int nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id)

{

	struct nvme_ctrl *ctrl = ns->ctrl;

	int ret;



	if (nvme_init_ms(ns, id))

		return;

	ret = nvme_init_ms(ns, id);

	if (ret)

		return ret;



	ns->features &= ~(NVME_NS_METADATA_SUPPORTED | NVME_NS_EXT_LBAS);

	if (!ns->ms || !(ctrl->ops->flags & NVME_F_METADATA_SUPPORTED))

		return;

		return 0;



	if (ctrl->ops->flags & NVME_F_FABRICS) {

		/*
@@ -1832,7 +1834,7 @@ static void nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id) 
		 * remap the separate metadata buffer from the block layer.

		 */

		if (WARN_ON_ONCE(!(id->flbas & NVME_NS_FLBAS_META_EXT)))

			return;

			return 0;



		ns->features |= NVME_NS_EXT_LBAS;
@@ -1859,6 +1861,7 @@ static void nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id) 
		else

			ns->features |= NVME_NS_METADATA_SUPPORTED;

	}

	return 0;

}



static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
@@ -2032,7 +2035,11 @@ static int nvme_update_ns_info_block(struct nvme_ns *ns, 
	ns->lba_shift = id->lbaf[lbaf].ds;

	nvme_set_queue_limits(ns->ctrl, ns->queue);



	nvme_configure_metadata(ns, id);

	ret = nvme_configure_metadata(ns, id);

	if (ret < 0) {

		blk_mq_unfreeze_queue(ns->disk->queue);

		goto out;

	}

	nvme_set_chunk_sectors(ns, id);

	nvme_update_disk_info(ns->disk, ns, id);