• James Smart's avatar
    nvmet_fc: fix crashes on bad opcodes · 188f7e8a
    James Smart authored
    if a nvme command is issued with an opcode that is not supported by
    the target (example: opcode 21 - detach namespace), the target
    crashes due to a null pointer.
    
    nvmet_req_init() detects the bad opcode and immediately calls the nvme
    command done routine with an error status, allowing the transport to
    send the response. However, the FC transport was aborting the command
    on error, so the abort freed the lldd point, but the rsp transmit path
    referenced it psot the free.
    
    Fix by removing the abort call on nvmet_req_init() failure.
    The completion response will be sent with an error status code.
    
    As the completion path will terminate the io, ensure the data_sg
    lists show an unused state so that teardown paths are successful.
    Signed-off-by: default avatarPaul Ely <Paul.Ely@broadcom.com>
    Signed-off-by: default avatarJames Smart <james.smart@broadcom.com>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    188f7e8a
fc.c 61.8 KB