nvme-tcp: fix possible req->offset corruption
authorVarun Prakash <varun@chelsio.com>
Tue, 26 Oct 2021 13:31:55 +0000 (19:01 +0530)
committerChristoph Hellwig <hch@lst.de>
Wed, 27 Oct 2021 05:58:26 +0000 (07:58 +0200)
commitce7723e9cdae4eb3030da082876580f4b2dc0861
treea5e1471acc87c1d2c157b04d2efe2658eb62a3f8
parent25e1f67eda4a19c91dc05c84d6d413c53efb447b
nvme-tcp: fix possible req->offset corruption

With commit db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq
context") r2t and response PDU can get processed while send function
is executing.

Current data digest send code uses req->offset after kernel_sendmsg(),
this creates a race condition where req->offset gets reset before it
is used in send function.

This can happen in two cases -
1. Target sends r2t PDU which resets req->offset.
2. Target send response PDU which completes the req and then req is
   used for a new command, nvme_tcp_setup_cmd_pdu() resets req->offset.

Fix this by storing req->offset in a local variable and using
this local variable after kernel_sendmsg().

Fixes: db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context")
Signed-off-by: Varun Prakash <varun@chelsio.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/host/tcp.c