Re: [PATCH] nvme-tcp: Check if request has started before processing it
From: Hannes Reinecke <hare@suse.de>
Date: 2021-02-13 08:48:38
Also in:
lkml
On 2/12/21 10:49 PM, Sagi Grimberg wrote:
quoted
quoted
quoted
blk_mq_tag_to_rq() will always return a request if the command_id is in the valid range. Check if the request has been started. If we blindly process the request we might double complete a request which can be fatal.How did you get to this one? did the controller send a completion for a completed/bogus request?If that is the case, then that must mean it's possible the driver could have started the command id just before the bogus completion check. Data iorruption, right?Yes, which is why I don't think this check is very useful..
I actually view that as a valid protection against spoofed frames. Without it it's easy to crash the machine by injecting fake completions with random command ids. Cheers, Hannes -- Dr. Hannes Reinecke Kernel Storage Architect hare@suse.de +49 911 74053 688 SUSE Software Solutions GmbH, Maxfeldstr. 5, 90409 Nürnberg HRB 36809 (AG Nürnberg), Geschäftsführer: Felix Imendörffer _______________________________________________ Linux-nvme mailing list Linux-nvme@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-nvme