From: Greg Kroah-Hartman Date: Sun, 19 Jul 2026 13:00:51 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d975fd89ffd0980baf777d8928a0aa8b8da4da7a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch --- diff --git a/queue-6.6/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch b/queue-6.6/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch new file mode 100644 index 0000000000..1e5c98c1c0 --- /dev/null +++ b/queue-6.6/nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch @@ -0,0 +1,42 @@ +From 4606467a75cfc16721937272ed29462a750b60c8 Mon Sep 17 00:00:00 2001 +From: Shivam Kumar +Date: Wed, 18 Mar 2026 18:56:58 -0400 +Subject: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path + +From: Shivam Kumar + +commit 4606467a75cfc16721937272ed29462a750b60c8 upstream. + +In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, +nvmet_req_uninit() is called unconditionally. However, if the command +arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() +had returned false and percpu_ref_tryget_live() was never executed. The +unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a +refcount underflow, leading to a WARNING in +percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and +eventually a permanent workqueue deadlock. + +Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling +nvmet_req_uninit(), matching the existing pattern in +nvmet_tcp_execute_request(). + +Reviewed-by: Christoph Hellwig +Signed-off-by: Shivam Kumar +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1297,7 +1297,8 @@ static int nvmet_tcp_try_recv_ddgst(stru + queue->idx, cmd->req.cmd->common.command_id, + queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst), + le32_to_cpu(cmd->exp_ddgst)); +- nvmet_req_uninit(&cmd->req); ++ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED)) ++ nvmet_req_uninit(&cmd->req); + nvmet_tcp_free_cmd_buffers(cmd); + nvmet_tcp_fatal_error(queue); + ret = -EPROTO; diff --git a/queue-6.6/nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch b/queue-6.6/nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch new file mode 100644 index 0000000000..41d58ff65d --- /dev/null +++ b/queue-6.6/nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch @@ -0,0 +1,50 @@ +From dbbd07d0a7020b80f6a7028e561908f7b83b3d5a Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Sun, 10 May 2026 23:30:29 +0300 +Subject: nvmet-tcp: Fix potential UAF when ddgst mismatch +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sagi Grimberg + +commit dbbd07d0a7020b80f6a7028e561908f7b83b3d5a upstream. + +Shivam Kumar found via vulnerability testing: +When data digest is enabled on an NVMe/TCP connection and a digest +mismatch occurs on a non-final H2C_DATA PDU during an R2T-based +data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() +calls nvmet_req_uninit() — which performs percpu_ref_put() on the +submission queue — but does NOT mark the command as completed. It +does not set cqe->status, does not modify rbytes_done, and does not +clear any flag. When the subsequent fatal error triggers queue +teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, +checks nvmet_tcp_need_data_in() for each one, and finds that the +already-uninited command still appears to need data (because +rbytes_done < transfer_len and cqe->status == 0). It therefore calls +nvmet_req_uninit() a second time on the same command — a double +percpu_ref_put against a single percpu_ref_get. + +Reported-by: Shivam Kumar +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/tcp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1297,8 +1297,10 @@ static int nvmet_tcp_try_recv_ddgst(stru + queue->idx, cmd->req.cmd->common.command_id, + queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst), + le32_to_cpu(cmd->exp_ddgst)); +- if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED)) ++ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED)) { ++ cmd->req.cqe->status = NVME_SC_CMD_SEQ_ERROR; + nvmet_req_uninit(&cmd->req); ++ } + nvmet_tcp_free_cmd_buffers(cmd); + nvmet_tcp_fatal_error(queue); + ret = -EPROTO; diff --git a/queue-6.6/series b/queue-6.6/series index f51755bd21..8e1583d151 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -329,3 +329,5 @@ sched-fair-only-update-stats-for-allowed-cpus-when-l.patch crypto-algif_skcipher-force-synchronous-processing-o.patch kvm-arm64-bound-used_lrs-when-flushing-the-pkvm-hyp-.patch kvm-arm64-clear-__hyp_running_vcpu-when-flushing-the.patch +nvmet-tcp-check-init_failed-before-nvmet_req_uninit-in-digest-error-path.patch +nvmet-tcp-fix-potential-uaf-when-ddgst-mismatch.patch