diff options
| author | Sagi Grimberg <sagi@grimberg.me> | 2022-09-05 13:54:17 +0300 |
|---|---|---|
| committer | Christoph Hellwig <hch@lst.de> | 2022-09-06 07:40:40 +0300 |
| commit | 160f3549a907a50e51a8518678ba2dcf2541abea (patch) | |
| tree | 7cd6018eb57355fd8bef27bda7aa27e17a4fd24b /drivers/nvme/host | |
| parent | 6a02a61e81c231cc5c680c5dbf8665275147ac52 (diff) | |
| download | linux-160f3549a907a50e51a8518678ba2dcf2541abea.tar.xz | |
nvme-tcp: fix UAF when detecting digest errors
We should also bail from the io_work loop when we set rd_enabled to true,
so we don't attempt to read data from the socket when the TCP stream is
already out-of-sync or corrupted.
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Reported-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'drivers/nvme/host')
| -rw-r--r-- | drivers/nvme/host/tcp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 044da18c06f5..54b4e8a7fe42 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -1229,7 +1229,7 @@ static void nvme_tcp_io_work(struct work_struct *w) else if (unlikely(result < 0)) return; - if (!pending) + if (!pending || !queue->rd_enabled) return; } while (!time_after(jiffies, deadline)); /* quota is exhausted */ |