From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
	Shivam Kumar <kumar.shivam43666@gmail.com>,
	Christoph Hellwig <hch@lst.de>,
	Sagi Grimberg <sagi@grimberg.me>,
	Keith Busch <kbusch@kernel.org>
Subject: Re: [PATCH 5.15.y] nvmet-tcp: Fix potential UAF when ddgst mismatch
Date: Mon, 20 Jul 2026 20:56:24 -0400
Message-ID: <20260720175500.0017-stable-reply@kernel.org>
In-Reply-To: <20260720140354.15968-1-kumar.shivam43666@gmail.com>
References: <20260720140354.15968-1-kumar.shivam43666@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

> When data digest is enabled on an NVMe/TCP connection and a digest
> mismatch occurs on a non-final H2C_DATA PDU during an R2T-based
> data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()
> calls nvmet_req_uninit() - which performs percpu_ref_put() on the
> submission queue - but does NOT mark the command as completed.

This one doesn't apply to linux-5.15.y: the diff context assumes
4606467a75cf ("nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in
digest error path") and the nvmet_tcp_finish_cmd() removal, neither of
which is in 5.15.y where the ddgst error path there still calls
nvmet_tcp_finish_cmd(cmd).

Your 5.15.y backport of 4606467a75cf was queued today, so could you
send a v2 of this patch generated on top of it? The end state in your
patch looks correct and can stay as-is.

-- 
Thanks,
Sasha