Commit 9b571c9d authored by Jim Harris's avatar Jim Harris Committed by Tomasz Zawadzki
Browse files

nvmf/tcp: check for control_msg_list before iterating its contents 



If in_capsule_data_size is configured big enough, the
control_msg_list doesn't get allocated. So we need to check for that
before iterating its contents in nvmf_tcp_request_get_buffers_abort().

Reported by: Gil Bregman <gbregman@il.ibm.com>
Signed-off-by: default avatarJim Harris <jim.harris@nvidia.com>
Change-Id: Ia53ebc2ab4fbf371825ad20385f6c768e08ffc55
Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/26772


Tested-by: default avatarSPDK Automated Test System <spdkbot@gmail.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarJacek Kalwas <jacek.kalwas@nutanix.com>
Reviewed-by: default avatarTomasz Zawadzki <tomasz@tzawadzki.com>
parent c9eab823

lib/nvmf/tcp.c

+8 −6
Original line number Diff line number Diff line
@@ -560,14 +560,16 @@ nvmf_tcp_request_get_buffers_abort(struct spdk_nvmf_tcp_req *tcp_req) 


	assert(tcp_req->state == TCP_REQUEST_STATE_NEED_BUFFER);



	STAILQ_FOREACH_SAFE(abort_req, &tcp_group->control_msg_list->waiting_for_msg_reqs, control_msg_link,

			    tmp_req) {

	if (tcp_group->control_msg_list != NULL) {

		STAILQ_FOREACH_SAFE(abort_req, &tcp_group->control_msg_list->waiting_for_msg_reqs,

				    control_msg_link, tmp_req) {

			if (abort_req == tcp_req) {

			STAILQ_REMOVE(&tcp_group->control_msg_list->waiting_for_msg_reqs, abort_req, spdk_nvmf_tcp_req,

				      control_msg_link);

				STAILQ_REMOVE(&tcp_group->control_msg_list->waiting_for_msg_reqs,

					      abort_req, spdk_nvmf_tcp_req, control_msg_link);

				return;

			}

		}

	}



	if (!nvmf_request_get_buffers_abort(&tcp_req->req)) {

		SPDK_ERRLOG("Failed to abort tcp_req=%p\n", tcp_req);