nvme-tcp uaf when tls setup fails

Daniel Wagner dwagner at suse.de
Mon Oct 14 07:35:45 PDT 2024


The errno EXDEV is from blk_mq_alloc_request_hctx. There is check if the
hctx is mapped to anyting. I forgot that I still had the --isolcpus
stuff enabled, thus the allocator returns EXDEV.

But the cleanup path still seems to miss to stop something and the
timeout handler fires 5 seconds later after the connection attempt
failed. This could be the keep alive timer...



More information about the Linux-nvme mailing list