2020-10-23 14:49:53

by zhenwei pi

Subject: [PATCH v2] nvme-rdma: handle nvme completion data length

Hit a kernel warning:
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 0 at lib/refcount.c:28

RIP: 0010:refcount_warn_saturate+0xd9/0xe0
Call Trace:
<IRQ>
nvme_rdma_recv_done+0xf3/0x280 [nvme_rdma]
__ib_process_cq+0x76/0x150 [ib_core]
...

The reason is that a zero bytes message received from target, and the
host side continues to process without length checking, then the
previous CQE is processed twice.

Handle data length, ignore zero bytes message, and try to recovery for
corrupted CQE case.

Thanks to Chao Leng for suggestions.

Signed-off-by: zhenwei pi <[email protected]>
---
drivers/nvme/host/rdma.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 9e378d0a0c01..2ecadd309f4a 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1767,6 +1767,21 @@ static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
return;
}

+ /* received data length checking */
+ if (unlikely(wc->byte_len < len)) {
+ /* zero bytes message could be ignored */
+ if (!wc->byte_len) {
+ nvme_rdma_post_recv(queue, qe);
+ return;
+ }
+
+ /* corrupted completion, try to recovry */
+ dev_err(queue->ctrl->ctrl.device,
+ "Unexpected nvme completion length(%d)\n", wc->byte_len);
+ nvme_rdma_error_recovery(queue->ctrl);
+ return;
+ }
+
ib_dma_sync_single_for_cpu(ibdev, qe->dma, len, DMA_FROM_DEVICE);
/*
* AEN requests are special as they don't time out and can
--
2.11.0

2020-10-23 19:08:27

by Sagi Grimberg

Subject: Re: [PATCH v2] nvme-rdma: handle nvme completion data length

> diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
> index 9e378d0a0c01..2ecadd309f4a 100644
> --- a/drivers/nvme/host/rdma.c
> +++ b/drivers/nvme/host/rdma.c
> @@ -1767,6 +1767,21 @@ static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
> return;
> }
>
> + /* received data length checking */
> + if (unlikely(wc->byte_len < len)) {
> + /* zero bytes message could be ignored */
> + if (!wc->byte_len) {
> + nvme_rdma_post_recv(queue, qe);
> + return;
> + }

Nothing in the spec defines zero-length messages, hence we cannot
support something that is not standard. If your array needs this,
please submit a TPAR to the NVMe TWG.

2020-10-24 11:44:26

by Christoph Hellwig

Subject: Re: [PATCH v2] nvme-rdma: handle nvme completion data length

On Fri, Oct 23, 2020 at 11:01:40AM -0700, Sagi Grimberg wrote:
>> + /* received data length checking */
>> + if (unlikely(wc->byte_len < len)) {
>> + /* zero bytes message could be ignored */
>> + if (!wc->byte_len) {
>> + nvme_rdma_post_recv(queue, qe);
>> + return;
>> + }
>
> Nothing in the spec defines zero-length messages, hence we cannot
> support something that is not standard. If your array needs this,
> please submit a TPAR to the NVMe TWG.

We'll still need sanity checking instead of the recount underflow,
I think tearing down the connection here and kicking off error recovery
is probably the best idea.