[5.10,233/289] nvmet-rdma: Fix NULL deref when SEND is completed with error

From: Michal Kalderon <michal.kalderon@marvell.com>

From: Michal Kalderon <michal.kalderon@marvell.com>

[ Upstream commit 8cc365f9559b86802afc0208389f5c8d46b4ad61 ]

When running some traffic and taking down the link on peer, a
retry counter exceeded error is received. This leads to
nvmet_rdma_error_comp which tried accessing the cq_context to
obtain the queue. The cq_context is no longer valid after the
fix to use shared CQ mechanism and should be obtained similar
to how it is obtained in other functions from the wc->qp.

[ 905.786331] nvmet_rdma: SEND for CQE 0x00000000e3337f90 failed with status transport retry counter exceeded (12).
[ 905.832048] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
[ 905.839919] PGD 0 P4D 0
[ 905.842464] Oops: 0000 1 SMP NOPTI
[ 905.846144] CPU: 13 PID: 1557 Comm: kworker/13:1H Kdump: loaded Tainted: G OE --------- - - 4.18.0-304.el8.x86_64 #1
[ 905.872135] RIP: 0010:nvmet_rdma_error_comp+0x5/0x1b [nvmet_rdma]
[ 905.878259] Code: 19 4f c0 e8 89 b3 a5 f6 e9 5b e0 ff ff 0f b7 75 14 4c 89 ea 48 c7 c7 08 1a 4f c0 e8 71 b3 a5 f6 e9 4b e0 ff ff 0f 1f 44 00 00 <48> 8b 47 48 48 85 c0 74 08 48 89 c7 e9 98 bf 49 00 e9 c3 e3 ff ff
[ 905.897135] RSP: 0018:ffffab601c45fe28 EFLAGS: 00010246
[ 905.902387] RAX: 0000000000000065 RBX: ffff9e729ea2f800 RCX: 0000000000000000
[ 905.909558] RDX: 0000000000000000 RSI: ffff9e72df9567c8 RDI: 0000000000000000
[ 905.916731] RBP: ffff9e729ea2b400 R08: 000000000000074d R09: 0000000000000074
[ 905.923903] R10: 0000000000000000 R11: ffffab601c45fcc0 R12: 0000000000000010
[ 905.931074] R13: 0000000000000000 R14: 0000000000000010 R15: ffff9e729ea2f400
[ 905.938247] FS: 0000000000000000(0000) GS:ffff9e72df940000(0000) knlGS:0000000000000000
[ 905.938249] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 905.950067] nvmet_rdma: SEND for CQE 0x00000000c7356cca failed with status transport retry counter exceeded (12).
[ 905.961855] CR2: 0000000000000048 CR3: 000000678d010004 CR4: 00000000007706e0
[ 905.961855] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 905.961856] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 905.961857] PKRU: 55555554
[ 906.010315] Call Trace:
[ 906.012778] __ib_process_cq+0x89/0x170 [ib_core]
[ 906.017509] ib_cq_poll_work+0x26/0x80 [ib_core]
[ 906.022152] process_one_work+0x1a7/0x360
[ 906.026182] ? create_worker+0x1a0/0x1a0
[ 906.030123] worker_thread+0x30/0x390
[ 906.033802] ? create_worker+0x1a0/0x1a0
[ 906.037744] kthread+0x116/0x130
[ 906.040988] ? kthread_flush_work_fn+0x10/0x10
[ 906.045456] ret_from_fork+0x1f/0x40

Fixes: ca0f1a8055be2 ("nvmet-rdma: use new shared CQ mechanism")
Signed-off-by: Shai Malin <smalin@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/rdma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Message ID	20210517140313.022095467@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Shai Malin <smalin@marvell.com>, Michal Kalderon <michal.kalderon@marvell.com>, Sagi Grimberg <sagi@grimberg.me>, Christoph Hellwig <hch@lst.de>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 233/289] nvmet-rdma: Fix NULL deref when SEND is completed with error Date: Mon, 17 May 2021 16:02:38 +0200 Message-Id: <20210517140313.022095467@linuxfoundation.org> In-Reply-To: <20210517140305.140529752@linuxfoundation.org> References: <20210517140305.140529752@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/289] tpm: fix error return code in tpm2_get_cc_attrs_tbl() [5.10,003/289] tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() [5.10,005/289] KVM: x86/mmu: Remove the defunct update_pte() paging hook [5.10,006/289] KVM/VMX: Invoke NMI non-IST entry instead of IST entry [5.10,007/289] ACPI: PM: Add ACPI ID of Alder Lake Fan [5.10,008/289] PM: runtime: Fix unpaired parent child_count for force_resume [5.10,010/289] kvm: Cap halt polling at kvm->max_halt_poll_ns [5.10,011/289] ath11k: fix thermal temperature read [5.10,012/289] fs: dlm: fix debugfs dump [5.10,013/289] fs: dlm: add errno handling to check callback [5.10,015/289] fs: dlm: flush swork on shutdown [5.10,017/289] ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF [5.10,022/289] i2c: bail out early when RDWR parameters are wrong [5.10,028/289] Bluetooth: initialize skb_queue_head at l2cap_chan_create() [5.10,029/289] net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports [5.10,030/289] net: bridge: when suppression is enabled exclude RARP packets [5.10,031/289] Bluetooth: check for zapped sk before connecting [5.10,034/289] net: hns3: remediate a potential overflow risk of bd_num_list [5.10,036/289] ip6_vti: proper dev_{hold\|put} in ndo_[un]init methods [5.10,037/289] ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet [5.10,040/289] ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055 [5.10,041/289] i2c: Add I2C_AQ_NO_REP_START adapter quirk [5.10,043/289] coresight: Do not scan for graph if none is present [5.10,044/289] IB/hfi1: Correct oversized ring allocation [5.10,046/289] pinctrl: samsung: use int for register masks in Exynos [5.10,049/289] mt76: mt76x0: disable GTK offloading [5.10,051/289] fuse: invalidate attrs when page writeback completes [5.10,053/289] cuse: prevent clone [5.10,054/289] iwlwifi: pcie: make cfg vs. trans_cfg more robust [5.10,055/289] powerpc/mm: Add cond_resched() while removing hpte mappings [5.10,056/289] ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() [5.10,057/289] Revert "iommu/amd: Fix performance counter initialization" [5.10,060/289] selftests: Set CC to clang in lib.mk if LLVM is set [5.10,065/289] sctp: Fix out-of-bounds warning in sctp_process_asconf_param() [5.10,066/289] flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target() [5.10,067/289] powerpc/smp: Set numa node before updating mask [5.10,070/289] net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule [5.10,073/289] drm/amd/display: fixed divide by zero kernel crash during dsc enablement [5.10,074/289] drm/amd/display: add handling for hdcp2 rx id list validation [5.10,075/289] drm/amdgpu: Add mem sync flag for IB allocated by SA [5.10,076/289] mt76: mt7615: fix entering driver-own state on mt7663 [5.10,077/289] crypto: ccp: Free SEV device if SEV init fails [5.10,078/289] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt [5.10,079/289] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join [5.10,082/289] iavf: remove duplicate free resources calls [5.10,083/289] net: ethernet: mtk_eth_soc: fix RX VLAN offload [5.10,085/289] selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test [5.10,086/289] kbuild: generate Module.symvers only when vmlinux exists [5.10,089/289] watchdog: rename __touch_watchdog() to a better descriptive name [5.10,090/289] watchdog: explicitly update timestamp when reporting softlockup [5.10,091/289] watchdog/softlockup: remove logic that tried to prevent repeated reports [5.10,093/289] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable [5.10,096/289] f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE [5.10,098/289] f2fs: fix panic during f2fs_resize_fs() [5.10,101/289] remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader [5.10,103/289] PCI: Release OF node in pci_scan_device()s error path [5.10,104/289] ARM: 9064/1: hw_breakpoint: Do not directly check the events overflow_handler hook [5.10,105/289] f2fs: fix to align to section for fallocate() on pinned file [5.10,110/289] PCI: endpoint: Fix NULL pointer dereference for ->get_features() [5.10,113/289] f2fs: Fix a hungtask problem in atomic write [5.10,114/289] f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block() [5.10,119/289] NFS: Deal correctly with attribute generation counter overflow [5.10,120/289] PCI: endpoint: Fix missing destroy_workqueue() [5.10,121/289] pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() [5.10,123/289] SUNRPC: Move fault injection call sites [5.10,126/289] thermal/drivers/tsens: Fix missing put_device error [5.10,128/289] nfsd: ensure new clients break delegations [5.10,131/289] dmaengine: idxd: fix dma device lifetime [5.10,132/289] dmaengine: idxd: fix cdev setup and free device lifetime issues [5.10,133/289] SUNRPC: fix ternary sign expansion bug in tracing [5.10,134/289] pwm: atmel: Fix duty cycle calculation in .get_state() [5.10,137/289] xprtrdma: rpcrdma_mr_pop() already does list_del_init() [5.10,142/289] scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend [5.10,143/289] scsi: ufs: core: Narrow down fast path in system suspend path [5.10,144/289] rtc: ds1307: Fix wday settings for rx8130 [5.10,145/289] net: hns3: fix incorrect configuration for igu_egu_hw_err [5.10,150/289] net: hns3: disable phy loopback setting in hclge_mac_start_phy [5.10,152/289] RISC-V: Fix error code returned by riscv_hartid_to_cpuid() [5.10,154/289] libbpf: Fix signed overflow in ringbuf_process_ring [5.10,156/289] block/rnbd-clt: Check the return value of the function rtrs_clt_query [5.10,157/289] ethernet:enic: Fix a use after free bug in enic_hard_start_xmit [5.10,162/289] drm/radeon: Fix off-by-one power_state index heap overwrite [5.10,164/289] arm64: entry: factor irq triage logic into macros [5.10,165/289] arm64: entry: always set GIC_PRIO_PSR_I_SET during entry [5.10,167/289] mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() [5.10,169/289] ksm: fix potential missing rmap_item for stable_node [5.10,171/289] mm/gup: return an error on migration failure [5.10,172/289] mm/gup: check for isolation errors [5.10,175/289] smc: disallow TCP_ULP in smc_setsockopt() [5.10,176/289] netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check [5.10,177/289] netfilter: nftables: Fix a memleak from userdata error path in new objects [5.10,178/289] can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path [5.10,183/289] fs/proc/generic.c: fix incorrect pde_is_permanent check [5.10,188/289] i40e: fix broken XDP support [5.10,191/289] i40e: Fix PHY type identifiers for 2.5G and 5G adapters [5.10,193/289] f2fs: avoid unneeded data copy in f2fs_ioc_move_range() [5.10,194/289] ARC: entry: fix off-by-one error in syscall number validation [5.10,198/289] powerpc/64s: Fix crashes when toggling entry flush barrier [5.10,206/289] arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache() [5.10,208/289] drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are conn... [5.10,209/289] drm/amd/display: Initialize attribute for hdcp_srm sysfs file [5.10,210/289] drm/i915: Avoid div-by-zero on gen2 [5.10,213/289] drm/msm/dp: initialize audio_comp when audio starts [5.10,214/289] KVM: x86: Cancel pvclock_gtod_work on module removal [5.10,215/289] KVM: x86: Prevent deadlock against tk_core.seq [5.10,216/289] dax: Add an enum for specifying dax wakup mode [5.10,218/289] dax: Wake up all waiters after invalidating dax entry [5.10,220/289] xen/unpopulated-alloc: fix error return code in fill_list() [5.10,222/289] usb: dwc3: gadget: Free gadget structure only after freeing endpoints [5.10,223/289] iio: light: gp2ap002: Fix rumtime PM imbalance on error [5.10,226/289] usb: fotg210-hcd: Fix an error message [5.10,227/289] hwmon: (occ) Fix poll rate limiting [5.10,229/289] ACPI: scan: Fix a memory leak in an error handling path [5.10,231/289] nvmet: add lba to sect conversion helpers [5.10,233/289] nvmet-rdma: Fix NULL deref when SEND is completed with error [5.10,234/289] f2fs: compress: fix to free compress page correctly [5.10,237/289] nbd: Fix NULL pointer in flush_workqueue [5.10,239/289] blk-mq: Swap two calls in blk_mq_exit_queue() [5.10,240/289] usb: dwc3: omap: improve extcon initialization [5.10,242/289] usb: xhci: Increase timeout for HC halt [5.10,244/289] usb: core: hub: fix race condition about TRSMRCY of resume [5.10,245/289] usb: dwc3: gadget: Enable suspend events [5.10,248/289] usb: typec: ucsi: Put fwnode in any case during ->probe() [5.10,249/289] xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI [5.10,251/289] xhci: Add reset resume quirk for AMD xhci controller. [5.10,256/289] KVM: x86: Emulate RDPID only if RDTSCP is supported [5.10,259/289] KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported [5.10,260/289] KVM: VMX: Disable preemption when probing user return MSRs [5.10,264/289] iommu/vt-d: Remove WO permissions on second-level paging entries [5.10,266/289] MIPS: Reinstate platform `__div64_32 handler [5.10,269/289] clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue [5.10,271/289] ARM: 9011/1: centralize phys-to-virt conversion of DT/ATAGS address [5.10,272/289] ARM: 9012/1: move device tree mapping out of linear region [5.10,274/289] ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section [5.10,276/289] kobject_uevent: remove warning in init_uevent_argv() [5.10,277/289] drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp [5.10,280/289] drm/i915: Fix crash in auto_retire [5.10,281/289] clk: exynos7: Mark aclk_fsys1_200 as critical [5.10,285/289] dt-bindings: serial: 8250: Remove duplicated compatible strings [5.10,286/289] debugfs: Make debugfs_allow RO after init [5.10,287/289] ext4: fix debug format string warning [5.10,289/289] ASoC: rsnd: check all BUSIF status when error

[5.10,233/289] nvmet-rdma: Fix NULL deref when SEND is completed with error

Commit Message

Patch