zhenwei pi db94f24028 nvmet-tcp: fix NULL pointer dereference during release ... nvmet-tcp frees CMD buffers in nvmet_tcp_uninit_data_in_cmds(), and waits the inflight IO requests in nvmet_sq_destroy(). During wait the inflight IO requests, the callback nvmet_tcp_queue_response() is called from backend after IO complete, this leads a typical Use-After-Free issue like this: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 107f80067 P4D 107f80067 PUD 10789e067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 123 Comm: kworker/1:1H Kdump: loaded Tainted: G E 6.0.0-rc2.bm.1-amd64 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: nvmet_tcp_wq nvmet_tcp_io_work [nvmet_tcp] RIP: 0010:shash_ahash_digest+0x2b/0x110 Code: 1f 44 00 00 41 57 41 56 41 55 41 54 55 48 89 fd 53 48 89 f3 48 83 ec 08 44 8b 67 30 45 85 e4 74 1c 48 8b 57 38 b8 00 10 00 00 <44> 8b 7a 08 44 29 f8 39 42 0c 0f 46 42 0c 41 39 c4 76 43 48 8b 03 RSP: 0018:ffffc9000051bdd8 EFLAGS: 00010206 RAX: 0000000000001000 RBX: ffff888100ab5470 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff888100ab5470 RDI: ffff888100ab5420 RBP: ffff888100ab5420 R08: ffff8881024d08c8 R09: ffff888103e1b4b8 R10: 8080808080808080 R11: 0000000000000000 R12: 0000000000001000 R13: 0000000000000000 R14: ffff88813412bd4c R15: ffff8881024d0800 FS: 0000000000000000(0000) GS:ffff88883fa40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000104b48000 CR4: 0000000000350ee0 Call Trace: <TASK> nvmet_tcp_io_work+0xa52/0xb52 [nvmet_tcp] ? __switch_to+0x106/0x420 process_one_work+0x1ae/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Separate nvmet_tcp_uninit_data_in_cmds() into two steps: uninit data in cmds <- new step 1 nvmet_sq_destroy(); cancel_work_sync(&queue->io_work); free CMD buffers <- new step 2 Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Christoph Hellwig <hch@lst.de>		2022-09-27 09:22:08 +02:00
..
admin-cmd.c	nvme: move from strlcpy with unused retval to strscpy	2022-09-19 11:33:53 +02:00
auth.c	nvmet-auth: fix a couple of spelling mistakes	2022-08-02 17:22:51 -06:00
configfs.c	nvmet: expose max queues to configfs	2022-09-19 17:55:16 +02:00
core.c	nvmet: implement basic In-Band Authentication	2022-08-02 17:14:49 -06:00
discovery.c	nvme: move from strlcpy with unused retval to strscpy	2022-09-19 11:33:53 +02:00
fabrics-cmd-auth.c	nvmet-auth: remove redundant parameters req	2022-09-19 11:33:54 +02:00
fabrics-cmd.c	nvme-auth: remove the redundant req->cqe->result.u16 assignment operation	2022-09-19 11:33:54 +02:00
fc.c	nvmet: use a private workqueue instead of the system workqueue	2022-03-29 09:29:04 +02:00
fcloop.c	nvmet: use a private workqueue instead of the system workqueue	2022-03-29 09:29:04 +02:00
io-cmd-bdev.c	nvmet: avoid unnecessary flush bio	2022-09-19 11:33:54 +02:00
io-cmd-file.c	keep iocb_flags() result cached in struct file	2022-06-10 16:10:23 -04:00
Kconfig	nvmet-auth: select the intended CRYPTO_DH_RFC7919_GROUPS	2022-08-02 17:22:51 -06:00
loop.c	nvme-loop: use nvme core helpers to cancel all requests in a tagset	2022-08-02 17:14:47 -06:00
Makefile	nvmet: implement basic In-Band Authentication	2022-08-02 17:14:49 -06:00
nvmet.h	nvmet-auth: expire authentication sessions	2022-08-02 17:14:50 -06:00
passthru.c	nvme: handle effects after freeing the request	2022-09-27 09:15:56 +02:00
rdma.c	RDMA/core: introduce ib_dma_pci_p2p_dma_supported()	2022-07-26 07:28:07 -04:00
tcp.c	nvmet-tcp: fix NULL pointer dereference during release	2022-09-27 09:22:08 +02:00
trace.c	nvmet: add set feature tracing support	2021-08-16 14:42:23 +02:00
trace.h	nvmet: use min of device_path and disk len	2021-02-10 16:38:05 +01:00
zns.c	nvme/target: Use the new blk_opf_t type	2022-07-14 12:14:32 -06:00