6.1-stable patches

added patches:
	nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch
	nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch

diff --git a/queue-6.1/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch b/queue-6.1/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch
new file mode 100644 (file)
index 0000000..3293c49
--- /dev/null
+++ b/queue-6.1/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch
@@ -0,0 +1,42 @@
+From 4606467a75cfc16721937272ed29462a750b60c8 Mon Sep 17 00:00:00 2001
+From: Shivam Kumar <kumar.shivam43666@gmail.com>
+Date: Wed, 18 Mar 2026 18:56:58 -0400
+Subject: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
+
+From: Shivam Kumar <kumar.shivam43666@gmail.com>
+
+commit 4606467a75cfc16721937272ed29462a750b60c8 upstream.
+
+In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
+nvmet_req_uninit() is called unconditionally. However, if the command
+arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
+had returned false and percpu_ref_tryget_live() was never executed. The
+unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
+refcount underflow, leading to a WARNING in
+percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
+eventually a permanent workqueue deadlock.
+
+Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
+nvmet_req_uninit(), matching the existing pattern in
+nvmet_tcp_execute_request().
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/tcp.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1258,7 +1258,8 @@ static int nvmet_tcp_try_recv_ddgst(stru
+                       queue->idx, cmd->req.cmd->common.command_id,
+                       queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
+                       le32_to_cpu(cmd->exp_ddgst));
+-              nvmet_req_uninit(&cmd->req);
++              if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
++                      nvmet_req_uninit(&cmd->req);
+               nvmet_tcp_free_cmd_buffers(cmd);
+               nvmet_tcp_fatal_error(queue);
+               ret = -EPROTO;

diff --git a/queue-6.1/nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch b/queue-6.1/nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch
new file mode 100644 (file)
index 0000000..70218bc
--- /dev/null
+++ b/queue-6.1/nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch
@@ -0,0 +1,50 @@
+From dbbd07d0a7020b80f6a7028e561908f7b83b3d5a Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Sun, 10 May 2026 23:30:29 +0300
+Subject: nvmet-tcp: Fix potential UAF when ddgst mismatch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+commit dbbd07d0a7020b80f6a7028e561908f7b83b3d5a upstream.
+
+Shivam Kumar found via vulnerability testing:
+When data digest is enabled on an NVMe/TCP connection and a digest
+mismatch occurs on a non-final H2C_DATA PDU during an R2T-based
+data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()
+calls nvmet_req_uninit() — which performs percpu_ref_put() on the
+submission queue — but does NOT mark the command as completed. It
+does not set cqe->status, does not modify rbytes_done, and does not
+clear any flag. When the subsequent fatal error triggers queue
+teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,
+checks nvmet_tcp_need_data_in() for each one, and finds that the
+already-uninited command still appears to need data (because
+rbytes_done < transfer_len and cqe->status == 0). It therefore calls
+nvmet_req_uninit() a second time on the same command — a double
+percpu_ref_put against a single percpu_ref_get.
+
+Reported-by: Shivam Kumar <kumar.shivam43666@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/tcp.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1258,8 +1258,10 @@ static int nvmet_tcp_try_recv_ddgst(stru
+                       queue->idx, cmd->req.cmd->common.command_id,
+                       queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
+                       le32_to_cpu(cmd->exp_ddgst));
+-              if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
++              if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED)) {
++                      cmd->req.cqe->status = NVME_SC_CMD_SEQ_ERROR;
+                       nvmet_req_uninit(&cmd->req);
++              }
+               nvmet_tcp_free_cmd_buffers(cmd);
+               nvmet_tcp_fatal_error(queue);
+               ret = -EPROTO;

diff --git a/queue-6.1/series b/queue-6.1/series
index 86682659a51a775117d2e5e01d88c22847761f79..b5ad63414838ab83640ff479ef5d4ea5b172a764 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -257,3 +257,5 @@ fs-quota-create-dedicated-workqueue-for-quota_releas.patch
 crypto-algif_skcipher-force-synchronous-processing-o.patch
 tools-mm-slabinfo-fix-total_objects-attribute-name.patch
 net-dsa-tag_ksz-do-not-rely-on-skb_mac_header-in-tx-.patch
+nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch
+nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch