[PATCH] NVMe/TCP: Fixed the out of order H2C PDU Crash

[Shivam]

From: Shivam <skumar47 at syr.edu>

Signed-off-by: Shivam Kumar <skumar47 at syr.edu>
---
 drivers/nvme/target/tcp.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 15416ff0eac4..cbd9286eabf4 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -982,6 +982,18 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
 		pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len);
 		goto err_proto;
 	}
+	/*
+	* Ensure command data structures are initialized. we must check both
+	* cmd->req.sg and cmd->iov because they can have different NULL state:
+	*- Unintialized commands: both NULL
+	*- READ commands: cmd->req.sg allocated, cmd->iov NULL
+	*- WRITE commands: both allocated
+	*/
+	if (unlikely(!cmd->req.sg || !cmd->iov)) {
+		pr_err("queue %d: H2CData PDU received for invalid command state (ttag %u)\n",
+			queue->idx, data->ttag);
+		goto err_proto;
+	}
 	cmd->pdu_recv = 0;
 	nvmet_tcp_build_pdu_iovec(cmd);
 	queue->cmd = cmd;
-- 
2.34.1