Re: Re: nvme-tcp: fix a possible UAF when failing to send request【请注意，邮件由sagigrim@xxxxxxxxx代发】

[zhang.guanghui@xxxxxxxx]

Yes, the problem here is that,  despite the nvme_tcp_try_send() failure, the target sends a response capsule for the command, leading to a UAF in the host. 

Is it more reasonable to disable queue->rd_enabled to prevent receiving. Thanks 
 
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index be04c5f3856d..17407eb12ad9 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1203,8 +1203,9 @@ static int nvme_tcp_try_send(struct nvme_tcp_queue *queue)
        } else if (ret < 0) {
                dev_err(queue->ctrl->ctrl.device,
                        "failed to send request %d\n", ret);
-               nvme_tcp_fail_request(queue->request);
                nvme_tcp_done_send_req(queue);
+              queue->rd_enabled = false;
+              nvme_tcp_error_recovery(&queue->ctrl->ctrl);
        }
 out:
        memalloc_noreclaim_restore(noreclaim_flag);




zhang.guanghui@xxxxxxxx



发件人： Maurizio Lombardi



发送时间： 2025-03-11 18:52



收件人： zhang.guanghui@xxxxxxxx; sagi; mgurtovoy; kbusch; sashal; chunguang.xu



抄送： linux-kernel; linux-nvme; linux-block



主题： Re: nvme-tcp: fix a possible UAF when failing to send request【请注意，邮件由sagigrim@xxxxxxxxx代发】



On Fri Mar 7, 2025 at 11:10 AM CET, zhang.guanghui@xxxxxxxx wrote:



>



> Hi



>



>         After testing this patch,   sending request failure occurred,   unfortunately, the issue still persists.



 



Maybe I am completely wrong but I am still quite convinced that the problem here



is that, despite the nvme_tcp_try_send() failure, the target sends a response capsule



for the command, leading to a double-completion in the host.



 



Sagi, what about taking this patch: https://lore.kernel.org/linux-nvme/20250306160322.1370300-2-mlombard@xxxxxxxxxx/T/#u



and do a step further by not completing the request, leaving the error



recovery handler the task of cleaning everything up?



 



 



diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c



index 327f3f2f5399..72c1d7948386 100644



--- a/drivers/nvme/host/tcp.c



+++ b/drivers/nvme/host/tcp.c



@@ -1328,8 +1328,8 @@ static int nvme_tcp_try_send(struct nvme_tcp_queue *queue)



} else if (ret < 0) {



dev_err(queue->ctrl->ctrl.device,



"failed to send request %d\n", ret);



- nvme_tcp_fail_request(queue->request);



nvme_tcp_done_send_req(queue);



+ nvme_tcp_error_recovery(&queue->ctrl->ctrl);



}



out:



memalloc_noreclaim_restore(noreclaim_flag);



 



 



Maurizio