Skip to content

Commit 528361c

Browse files
Dan Carpenterkeithbusch
authored andcommitted
nvme-tcp: fix signedness bug in nvme_tcp_init_connection()
The kernel_recvmsg() function returns an int which could be either negative error codes or the number of bytes received. The problem is that the condition: if (ret < sizeof(*icresp)) { is type promoted to type unsigned long and negative values are treated as high positive values which is success, when they should be treated as failure. Handle invalid positive returns separately from negative error codes to avoid this problem. Fixes: 578539e ("nvme-tcp: fix connect failure on receiving partial ICResp PDU") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Caleb Sander Mateos <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Reviewed-by: Chaitanya Kulkarni <[email protected]> Signed-off-by: Keith Busch <[email protected]>
1 parent a16f889 commit 528361c

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

drivers/nvme/host/tcp.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1521,11 +1521,11 @@ static int nvme_tcp_init_connection(struct nvme_tcp_queue *queue)
15211521
msg.msg_flags = MSG_WAITALL;
15221522
ret = kernel_recvmsg(queue->sock, &msg, &iov, 1,
15231523
iov.iov_len, msg.msg_flags);
1524-
if (ret < sizeof(*icresp)) {
1524+
if (ret >= 0 && ret < sizeof(*icresp))
1525+
ret = -ECONNRESET;
1526+
if (ret < 0) {
15251527
pr_warn("queue %d: failed to receive icresp, error %d\n",
15261528
nvme_tcp_queue_id(queue), ret);
1527-
if (ret >= 0)
1528-
ret = -ECONNRESET;
15291529
goto free_icresp;
15301530
}
15311531
ret = -ENOTCONN;

0 commit comments

Comments
 (0)