nvme-tcp: don't access released socket during error recovery
authorAkinobu Mita <akinobu.mita@gmail.com>
Sun, 26 Feb 2023 12:42:54 +0000 (21:42 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 11 Mar 2023 12:55:31 +0000 (13:55 +0100)
commitfe2d9e54165dadaa0d0cc3355c0be9c3e129fa0d
treede310f620be6baeb0c3cffaaf47118a8c48cf409
parent117dc3f6b64150e8a10c5037b0d0b3556233980b
nvme-tcp: don't access released socket during error recovery

[ Upstream commit 76d54bf20cdcc1ed7569a89885e09636e9a8d71d ]

While the error recovery work is temporarily failing reconnect attempts,
running the 'nvme list' command causes a kernel NULL pointer dereference
by calling getsockname() with a released socket.

During error recovery work, the nvme tcp socket is released and a new one
created, so it is not safe to access the socket without proper check.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Fixes: 02c57a82c008 ("nvme-tcp: print actual source IP address through sysfs "address" attr")
Reviewed-by: Martin Belanger <martin.belanger@dell.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/nvme/host/tcp.c