From nobody Sun May 24 19:33:21 2026 Received: from mail-vs1-f49.google.com (mail-vs1-f49.google.com [209.85.217.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 655EE2E285C for ; Fri, 22 May 2026 15:30:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.217.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779463838; cv=none; b=QpW8pYzsGm2RslhaEoO6gf7lS0sXnbVE4D7IrcfTYwM0DTih8VnqHR/5MYK2DAvn1SlcQNYV9WKeBkQCcPapcG1G9r4zP0Ux8h7uWirQX4jA2vQ5xCs3LHllzcDppMwYaZ1Pw5qrRwc9KR2a+L7nVSBQa01dALNIRPFKv9MQfhs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779463838; c=relaxed/simple; bh=Yaj3V3CHiv94K2TkKa1DUE9tw2GcTv5Cm8EMDaI2jSw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=R+tNOdKuR5DD89lZnxcIfmUPIWeut5RTMcWH8geihlZEIegwW50lFzGFtNmeC+Zq21Gy6JQatMfEWccy5IC9B2GRPZxqG+fQ59ZzLCDoI+CKaf7TrPl2oUyEBXc1NOchQKVd3yOTTq9RZV/O67pYTg2gnvsbAGQjqcuhn8Ah0n8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QVnl1RTc; arc=none smtp.client-ip=209.85.217.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QVnl1RTc" Received: by mail-vs1-f49.google.com with SMTP id ada2fe7eead31-6314a0eefb1so2346190137.2 for ; Fri, 22 May 2026 08:30:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779463836; x=1780068636; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=VtekpR6cey4CtTWV4xkrXalV8L8MRvhbyb3+vKP/acc=; b=QVnl1RTcvs5Ve8Lgc7xweLZquHT8DBdvBAAKRCs6q5gT0tIY/3LExSurMW9hSqnPlF xEEhQ3JDcBbYqygjWQ2Qh8/WQgfo99OXOf9RCK3hcSJR2xrOnOp3f39k1jcR9dBorEbt FFybEB1hceo1/fPjOzrSwMjfxwdDzzIGYVUneZwGre3PFcAUoTYJ5hp086ZprRn3TRyb L7+Xlck8mnUBSriXsffHY1dv+S6nRknRy/5xZBpLcok5k+5LEZoCqBUIlAxxwdUgoW67 D4HNvkdsQjGwKY2tyDTzs4GqUABQhn6JI+yz7aQN3S0SaPlAEWSLNpgWR3/jlAwmtjUn /lxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779463836; x=1780068636; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=VtekpR6cey4CtTWV4xkrXalV8L8MRvhbyb3+vKP/acc=; b=bFVafJ4suD2rjVR/yNN8p9Z9PQABOhFdrjrOl69Sj8yFBiTXgyy6dKtlcPhyoKDPDV VUqohiactVTZgeM4NsUb6Uv3XgqK/Q8tUx0IGG6u3f0LX0tn2Qmmsq/2f3cFWzzCvWAj T62aLBNeWO28gk3MYgD9q8TZ5hjxOkvTMAowK24ULyQ4W6AS7S6ACDfR3ufJxcirQosj ikyXoo5wvQW6IFiKPSNUoksD/kIAgha77/J/oRChaQatM26YAugoDEiGKstfqFnbnaTE r/v8OzskpSuRlwUtcFXGaXv9lsdJh5sSK7Y+Q9F9essS7Bg0EKZ8VqpHMb5t8GkVRE5h 29Qg== X-Forwarded-Encrypted: i=1; AFNElJ9/E+LRqofTVmnxlpIuuXFvbUkCTPOqT6wYX5krTwYGwooRroCVknP0MXBq/ic+PxcmTt/kKtHWvaC4W8A=@vger.kernel.org X-Gm-Message-State: AOJu0YwCspA9n3KSEV8VRUT8sB21tqG5c+ZC54eQrA9yT3lE4Tr7hEkd gcb+BCzlFSr5JTXnaw9PwqsJo3pABQUIphnoTednmwwkfQVDEagj0PmK X-Gm-Gg: Acq92OH4D8jY+rjq83VDubc7xThefDB+ntq4KdI2mmr6FbsY14i3rzu/MWkruUlxiFO rYjPwdIU/65wLIG6kepqWt7Zwsz5iZ8CD1c2bAsF5O8/dKKHwlfyzHAzGvCQ30WAqpmfaIMS6IJ ZHxJtE7W+4sXr/q6bdalW2PzGVAw0yJTD/LPYdj4H7X0hwqELE+GRfiySJGY6sS2IbDfd75YAzs Nr9RBwClQsNYxdpIgS1bu9nQP6z2hlfEsNvgmfyZh+ug6Ztqv2gpM/CidFP/WoR37XQX0cIjszN zfZLIHbPjKm0uBrtM1z1YbCj6fMv5ag+SwvJK+8e/zge8Sr2Jsmz+VmVq1cV4KhtcQjRl9VQ8Kh l4evWuApweu3DUzgw0mSbaOf03ilZxQel+0odRWq+XPvdjDhL2Q3WUIXb32KeIps68EXRcS5QEs KENetsYQFBh3xy0Cxe8fjOPL5isyZpDPmQ9+OCMla1Sw== X-Received: by 2002:a05:6102:4bc2:b0:634:a573:c097 with SMTP id ada2fe7eead31-67c79ebaac5mr2242680137.13.1779463836252; Fri, 22 May 2026 08:30:36 -0700 (PDT) Received: from syssplab.cs.fiu.edu (nat1.cs.fiu.edu. [131.94.134.89]) by smtp.gmail.com with ESMTPSA id a1e0cc1a2514c-96177c1a9e4sm1585228241.0.2026.05.22.08.30.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 22 May 2026 08:30:35 -0700 (PDT) From: Chao Shi To: Keith Busch , Jens Axboe , Christoph Hellwig , Sagi Grimberg Cc: linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, Chao Shi , Sungwoo Kim , Dave Tian , Weidong Zhu Subject: [PATCH] nvme: reject completions for requests that are not in flight Date: Fri, 22 May 2026 11:30:34 -0400 Message-ID: <20260522153034.2168862-1-coshi036@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nvme_find_rq() resolves a device-supplied command id to a request with blk_mq_tag_to_rq(), which returns whatever request last used that tag - possibly one that is no longer in flight (freed, or never dispatched and thus with a NULL rq->mq_hctx). Commit e7006de6c238 ("nvme: code command_id with a genctr for use-after-free validation") guards against this, but its generation counter is only 4 bits wide and can be matched by a malfunctioning or malicious device replaying command ids. The driver then completes a request that is not outstanding, dereferencing a NULL rq->mq_hctx or double-completing a command: Oops: general protection fault ... KASAN: null-ptr-deref RIP: blk_mq_complete_request_remote+0xe5/0xa80 block/blk-mq.c:1319 nvme_handle_cqe drivers/nvme/host/pci.c:1418 [inline] nvme_poll_cq drivers/nvme/host/pci.c:1449 nvme_irq drivers/nvme/host/pci.c:1463 Require the request to be in flight before completing it. The check uses the request state, so it also covers controllers with NVME_QUIRK_SKIP_CID_GEN. Found by FuzzNvme(Syzkaller with FEMU fuzzing framework). Acked-by: Sungwoo Kim Acked-by: Dave Tian Acked-by: Weidong Zhu Signed-off-by: Chao Shi --- drivers/nvme/host/nvme.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h index 9a5f28c5103c..3a525c1dc818 100644 --- a/drivers/nvme/host/nvme.h +++ b/drivers/nvme/host/nvme.h @@ -615,6 +615,17 @@ static inline struct request *nvme_find_rq(struct blk_= mq_tags *tags, tag); return NULL; } + /* + * blk_mq_tag_to_rq() returns whatever request last used this tag, which + * may no longer be in flight if the device reports a bogus command id. + * Completing it would deref a NULL rq->mq_hctx or double-complete a + * command; the 4-bit genctr below only narrows the window. + */ + if (unlikely(blk_mq_rq_state(rq) !=3D MQ_RQ_IN_FLIGHT)) { + dev_err(nvme_req(rq)->ctrl->device, + "completion for request %#x not in flight\n", tag); + return NULL; + } if (unlikely(nvme_genctr_mask(nvme_req(rq)->genctr) !=3D genctr)) { dev_err(nvme_req(rq)->ctrl->device, "request %#x genctr mismatch (got %#x expected %#x)\n", --=20 2.43.0