[Bug Report] NVMe-oF/TCP - NULL Pointer Dereference in `nvmet_tcp_execute_request`

[Guoqing Jiang]

On 11/20/23 06:18, Alon Zahavi wrote:
> On Thu, 16 Nov 2023 at 05:28, Guoqing Jiang <guoqing.jiang at linux.dev> wrote:
>>
>> Could you try the change to see if it helps?
>>
>> --- a/drivers/nvme/target/tcp.c
>> +++ b/drivers/nvme/target/tcp.c
>> @@ -1062,7 +1062,7 @@ static int nvmet_tcp_done_recv_pdu(struct
>> nvmet_tcp_queue *queue)
>> le32_to_cpu(req->cmd->common.dptr.sgl.length));
>>
>>                   nvmet_tcp_handle_req_failure(queue, queue->cmd, req);
>> -               return 0;
>> +               return -EAGAIN;
>>           }
>>
>> Thanks,
>> Guoqing
> Checked it.
> Although it seems useful to return some error here anyways, it doesn't
> help with the bug.
> The flow leading to the NULL deref doesn't reach this code at all,
> which is probably
> part of why it happens.
> The call trace looks like this:
> ```
>   nvmet_tcp_execute_request drivers/nvme/target/tcp.c:578 [inline]
>   nvmet_tcp_try_recv_data drivers/nvme/target/tcp.c:1232 [inline]
>   nvmet_tcp_try_recv_one drivers/nvme/target/tcp.c:1312 [inline]
>   nvmet_tcp_try_recv drivers/nvme/target/tcp.c:1338 [inline]
>   nvmet_tcp_io_work+0x202a/0x2990 drivers/nvme/target/tcp.c:1388
> ```
> so `nvmet_tcp_done_recv_pdu` is not called here.

My guess is if  rcv_state == NVMET_TCP_RECV_PDU, so

nvmet_tcp_try_recv_one -> nvmet_tcp_try_recv_pdu
                                                 -> return 
nvmet_tcp_done_recv_pdu
                                                     -> 
nvmet_tcp_handle_req_failure
                                                         -> *rcv_state = 
NVMET_TCP_RECV_DATA*
                                                     -> return 0

then back to nvmet_tcp_try_recv_one, it continues to call
nvmet_tcp_try_recv_data instead of goto done_recv.

Thanks,
Guoqing