nvme-rdma: handle unexpected nvme completion data length
[ Upstream commit 25c1ca6eca
]
Receiving a zero length message leads to the following warnings because
the CQE is processed twice:
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 0 at lib/refcount.c:28
RIP: 0010:refcount_warn_saturate+0xd9/0xe0
Call Trace:
<IRQ>
nvme_rdma_recv_done+0xf3/0x280 [nvme_rdma]
__ib_process_cq+0x76/0x150 [ib_core]
...
Sanity check the received data length, to avoids this.
Thanks to Chao Leng & Sagi for suggestions.
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
5.4-rM2-2.2.x-imx-squashed
parent
2fd9e60760
commit
8c9c034325
|
@ -1520,6 +1520,14 @@ static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* sanity checking for received data length */
|
||||||
|
if (unlikely(wc->byte_len < len)) {
|
||||||
|
dev_err(queue->ctrl->ctrl.device,
|
||||||
|
"Unexpected nvme completion length(%d)\n", wc->byte_len);
|
||||||
|
nvme_rdma_error_recovery(queue->ctrl);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
ib_dma_sync_single_for_cpu(ibdev, qe->dma, len, DMA_FROM_DEVICE);
|
ib_dma_sync_single_for_cpu(ibdev, qe->dma, len, DMA_FROM_DEVICE);
|
||||||
/*
|
/*
|
||||||
* AEN requests are special as they don't time out and can
|
* AEN requests are special as they don't time out and can
|
||||||
|
|
Loading…
Reference in New Issue