netdev - Re: [PATCH net] nvme-tcp: Fix comma-related oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZJ7yyEiUWBTf8cCp@kbusch-mbp.dhcp.thefacebook.com>
Date: Fri, 30 Jun 2023 09:20:40 -0600
From: Keith Busch <kbusch@...nel.org>
To: David Howells <dhowells@...hat.com>
Cc: netdev@...r.kernel.org, Aurelien Aptel <aaptel@...dia.com>,
	Sagi Grimberg <sagi@...mberg.me>,
	Willem de Bruijn <willemb@...gle.com>, Jens Axboe <axboe@...com>,
	Christoph Hellwig <hch@....de>, Chaitanya Kulkarni <kch@...dia.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Jens Axboe <axboe@...nel.dk>, Matthew Wilcox <willy@...radead.org>,
	linux-nvme@...ts.infradead.org
Subject: Re: [PATCH net] nvme-tcp: Fix comma-related oops

On Thu, Jun 29, 2023 at 10:47:53PM +0100, David Howells wrote:
> Fix a comma that should be a semicolon.  The comma is at the end of an
> if-body and thus makes the statement after (a bvec_set_page()) conditional
> too, resulting in an oops because we didn't fill out the bio_vec[]:
> 
>     BUG: kernel NULL pointer dereference, address: 0000000000000008
>     #PF: supervisor read access in kernel mode
>     #PF: error_code(0x0000) - not-present page
>     ...
>     Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp]
>     RIP: 0010:skb_splice_from_iter+0xf1/0x370
>     ...
>     Call Trace:
>      tcp_sendmsg_locked+0x3a6/0xdd0
>      tcp_sendmsg+0x31/0x50
>      inet_sendmsg+0x47/0x80
>      sock_sendmsg+0x99/0xb0
>      nvme_tcp_try_send_data+0x149/0x490 [nvme_tcp]
>      nvme_tcp_try_send+0x1b7/0x300 [nvme_tcp]
>      nvme_tcp_io_work+0x40/0xc0 [nvme_tcp]
>      process_one_work+0x21c/0x430
>      worker_thread+0x54/0x3e0
>      kthread+0xf8/0x130
> 
> Fixes: 7769887817c3 ("nvme-tcp: Use sendmsg(MSG_SPLICE_PAGES) rather then sendpage")

We don't have this breaking commit in the nvme tree just yet, so feel
free to take the fix through net if this can't wait for the next nvme
rebase (we're based on the block tree).