3856d82b50
At the RDMA level, we allow processing requests that should contain a data transfer, but specify a length of zero to be passed up the stack without a data buffer. See spdk_nvmf_rdma_request_get_xfer. In the case of the reservation requests, we weren't checking whether req->data was NULL before trying to copy into it causing us to segfault if we got a malformed reservation request. Found when using the fuzzer. Change-Id: I320174ec72a8d298ab6ca44ef6a99691631f00ca Signed-off-by: Seth Howell <seth.howell@intel.com> Reviewed-on: https://review.gerrithub.io/c/spdk/spdk/+/451786 Tested-by: SPDK CI Jenkins <sys_sgci@intel.com> Reviewed-by: Changpeng Liu <changpeng.liu@intel.com> Reviewed-by: Jim Harris <james.r.harris@intel.com> |
||
|---|---|---|
| .. | ||
| ctrlr_bdev.c | ||
| ctrlr_discovery.c | ||
| ctrlr.c | ||
| Makefile | ||
| nvmf_fc.h | ||
| nvmf_internal.h | ||
| nvmf.c | ||
| rdma.c | ||
| subsystem.c | ||
| tcp.c | ||
| transport.c | ||
| transport.h | ||