nvme: Don't use a stack buffer for keep-alive command

Web:        https://git.kernel.org/torvalds/c/0a34e4668c508cbbc2d5ef2d9710b145e4c0b27d
Commit:     0a34e4668c508cbbc2d5ef2d9710b145e4c0b27d
Parent:     c3aedd225f8bcc3b3e61df074bc045b80542b38a
Refname:    refs/heads/master
Author:     Roland Dreier <[email protected]>
AuthorDate: Thu Jan 11 13:38:15 2018 -0800
Committer:  Sagi Grimberg <[email protected]>
CommitDate: Mon Feb 12 22:18:14 2018 +0200

    nvme: Don't use a stack buffer for keep-alive command
    
    In nvme_keep_alive() we pass a request with a pointer to an NVMe command on
    the stack into blk_execute_rq_nowait().  However, the block layer doesn't
    guarantee that the request is fully queued before blk_execute_rq_nowait()
    returns.  If not, and the request is queued after nvme_keep_alive() returns,
    then we'll end up using stack memory that might have been overwritten to
    form the NVMe command we pass to hardware.
    
    Fix this by keeping a special command struct in the nvme_ctrl struct right
    next to the delayed work struct used for keep-alives.
    
    Signed-off-by: Roland Dreier <[email protected]>
    Signed-off-by: Sagi Grimberg <[email protected]>
---
 drivers/nvme/host/core.c | 8 +++-----
 drivers/nvme/host/nvme.h | 1 +
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 2fd8688cfa47..6d0490b477c9 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -796,13 +796,9 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
 
 static int nvme_keep_alive(struct nvme_ctrl *ctrl)
 {
-	struct nvme_command c;
 	struct request *rq;
 
-	memset(&c, 0, sizeof(c));
-	c.common.opcode = nvme_admin_keep_alive;
-
-	rq = nvme_alloc_request(ctrl->admin_q, &c, BLK_MQ_REQ_RESERVED,
+	rq = nvme_alloc_request(ctrl->admin_q, &ctrl->ka_cmd, BLK_MQ_REQ_RESERVED,
 			NVME_QID_ANY);
 	if (IS_ERR(rq))
 		return PTR_ERR(rq);
@@ -834,6 +830,8 @@ void nvme_start_keep_alive(struct nvme_ctrl *ctrl)
 		return;
 
 	INIT_DELAYED_WORK(&ctrl->ka_work, nvme_keep_alive_work);
+	memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+	ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
 	schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
 }
 EXPORT_SYMBOL_GPL(nvme_start_keep_alive);
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 27e31c00b306..0521e4707d1c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -183,6 +183,7 @@ struct nvme_ctrl {
 	struct work_struct scan_work;
 	struct work_struct async_event_work;
 	struct delayed_work ka_work;
+	struct nvme_command ka_cmd;
 	struct work_struct fw_act_work;
 
 	/* Power saving configuration */
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html