linux-kernel - Re: [PATCH] nvme: target: fix error checking in nvmet_fc_schedule_delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2bc10e91-d937-4584-967d-133487524980@flourine.local>
Date: Mon, 6 Oct 2025 14:44:31 +0200
From: Daniel Wagner <dwagner@...e.de>
To: Alexandr Sapozhnkiov <alsp705@...il.com>
Cc: James Smart <james.smart@...adcom.com>, 
	Sagi Grimberg <sagi@...mberg.me>, Chaitanya Kulkarni <kch@...dia.com>, 
	linux-nvme@...ts.infradead.org, linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org, 
	Daniel Wagner <wagi@...nel.org>, Christoph Hellwig <hch@....de>
Subject: Re: [PATCH] nvme: target: fix error checking in
 nvmet_fc_schedule_delete_assoc()

Hi Alexandr,

On Fri, Oct 03, 2025 at 12:13:54PM +0200, Christoph Hellwig wrote:
> Adding Daniel who has been touching this area recently.
> 
> On Thu, Oct 02, 2025 at 12:22:01PM +0300, Alexandr Sapozhnkiov wrote:
> > From: Alexandr Sapozhnikov <alsp705@...il.com>
> > 
> > The nvmet_fc_tgtport_get() function may return an error.

This description is not correct, because nvmet_fc_tgtport_get wraps
around kref_get_unless_zero. The return value is never an error code.

> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > 
> > Signed-off-by: Alexandr Sapozhnikov <alsp705@...il.com>
> > ---
> >  drivers/nvme/target/fc.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
> > index 337ee1cb09ae..68a416a92bfc 100644
> > --- a/drivers/nvme/target/fc.c
> > +++ b/drivers/nvme/target/fc.c
> > @@ -1110,8 +1110,8 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
> >  static void
> >  nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
> >  {
> > -	nvmet_fc_tgtport_get(assoc->tgtport);
> > -	queue_work(nvmet_wq, &assoc->del_work);
> > +	if (nvmet_fc_tgtport_get(assoc->tgtport))
> > +		queue_work(nvmet_wq, &assoc->del_work);

nvmet_fc_schedule_delete_assoc can only be called when a reference is
held on the assoc->tgtport. The nvmet_fc_tgtport_get is necessary so
that the resource is not going away while the work item is executed.

And this patch doesn't seem against a recent kernel as it misses commit
70289ae5cac4 ("nvmet-fc: put ref when assoc->del_work is already
scheduled") which was added for 6.15.

I am not against this change but I was under the impression we don't add
code to make some tools happy. Maybe it would be enough to add a
comment?

Thanks,
Daniel