[PATCH] nvme-tcp: don't access released socket during error recovery

[Hannes Reinecke]

On 2/26/23 13:42, Akinobu Mita wrote:
> While the error recovery work is temporarily failing reconnect attempts,
> running the 'nvme list' command causes a kernel NULL pointer dereference
> by calling getsockname() with a released socket.
> 
> During error recovery work, the nvme tcp socket is released and a new one
> created, so it is not safe to access the socket without proper check.
> 
> Signed-off-by: Akinobu Mita <akinobu.mita at gmail.com>
> Fixes: 02c57a82c008 ("nvme-tcp: print actual source IP address through sysfs "address" attr")
> Cc: Martin Belanger <martin.belanger at dell.com>
> Cc: Sagi Grimberg <sagi at grimberg.me>
> Cc: Chaitanya Kulkarni <kch at nvidia.com>
> Cc: Christoph Hellwig <hch at lst.de>
> Cc: Keith Busch <kbusch at kernel.org>
> Cc: Jens Axboe <axboe at fb.com>
> Cc: Hannes Reinecke <hare at suse.de>
> ---
>   drivers/nvme/host/tcp.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
> index 1955c0ec209e..7723a4989524 100644
> --- a/drivers/nvme/host/tcp.c
> +++ b/drivers/nvme/host/tcp.c
> @@ -2492,6 +2492,10 @@ static int nvme_tcp_get_address(struct nvme_ctrl *ctrl, char *buf, int size)
>   
>   	len = nvmf_get_address(ctrl, buf, size);
>   
> +	mutex_lock(&queue->queue_lock);
> +
> +	if (!test_bit(NVME_TCP_Q_LIVE, &queue->flags))
> +		goto done;
>   	ret = kernel_getsockname(queue->sock, (struct sockaddr *)&src_addr);
>   	if (ret > 0) {
>   		if (len > 0)
> @@ -2499,6 +2503,8 @@ static int nvme_tcp_get_address(struct nvme_ctrl *ctrl, char *buf, int size)
>   		len += scnprintf(buf + len, size - len, "%ssrc_addr=%pISc\n",
>   				(len) ? "," : "", &src_addr);
>   	}
> +done:
> +	mutex_unlock(&queue->queue_lock);
>   
>   	return len;
>   }
Reviewed-by: Hannes Reinecke <hare at suse.de>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                Kernel Storage Architect
hare at suse.de                              +49 911 74053 688
SUSE Software Solutions GmbH, Maxfeldstr. 5, 90409 Nürnberg
HRB 36809 (AG Nürnberg), Geschäftsführer: Ivo Totev, Andrew
Myers, Andrew McDonald, Martje Boudien Moerman