From: Hou Pu <houpu.main@gmail.com>
Date: Thu, 20 May 2021 11:30:45 +0000 (+0800)
Subject: nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
X-Git-Tag: v5.10.42~126
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cb554bbf364ba8b6925456e8207f3a12ad275e48;p=thirdparty%2Fkernel%2Fstable.git

nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response

commit 25df1acd2d36eb72b14c3d00f6b861b1e00b3aab upstream.

Using "<=" instead "<" to compare inline data size.

Fixes: bdaf13279192 ("nvmet-tcp: fix a segmentation fault during io parsing error")
Signed-off-by: Hou Pu <houpu.main@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index d958b5da9b88a..4df4f37e6b895 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -538,7 +538,7 @@ static void nvmet_tcp_queue_response(struct nvmet_req *req)
 		 * nvmet_req_init is completed.
 		 */
 		if (queue->rcv_state == NVMET_TCP_RECV_PDU &&
-		    len && len < cmd->req.port->inline_data_size &&
+		    len && len <= cmd->req.port->inline_data_size &&
 		    nvme_is_write(cmd->req.cmd))
 			return;
 	}