nvme-rdma: handle unexpected nvme completion data length
authorzhenwei pi <pizhenwei@bytedance.com>
Sun, 25 Oct 2020 11:51:24 +0000 (19:51 +0800)
committerChristoph Hellwig <hch@lst.de>
Tue, 27 Oct 2020 09:00:05 +0000 (10:00 +0100)
commit25c1ca6ecaba3b751d3f7ff92d5cddff3b05f8d0
tree9fc7108b3d04b889173410c6a5dffb1bebf4d212
parent8685699c28d7452ff06d62b4692df985eb7301f0
nvme-rdma: handle unexpected nvme completion data length

Receiving a zero length message leads to the following warnings because
the CQE is processed twice:

refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 0 at lib/refcount.c:28

RIP: 0010:refcount_warn_saturate+0xd9/0xe0
Call Trace:
 <IRQ>
 nvme_rdma_recv_done+0xf3/0x280 [nvme_rdma]
 __ib_process_cq+0x76/0x150 [ib_core]
 ...

Sanity check the received data length, to avoids this.

Thanks to Chao Leng & Sagi for suggestions.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/host/rdma.c