Spdk/lib/nvme
Sylvain Didelot 4cd97383cc nvme_cuse: Fix NULL pointer dereference triggered by unit test
The unit test test_nvme_cuse_stop() manually creates 2 cuse devices
and executes nvme_cuse_stop(). Problem is that the Fuse session is
never initialized for those 2 cuse devices, causing cuse_nvme_ns_stop()
to access 'ns_device->session', which is a NULL pointer.

This bug is detected by ASAN as follows:

==77298==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000180 (pc 0x7fdac6d7d40e bp 0x000000000000 sp 0x7fff74768320 T0)
==77298==The signal is caused by a READ memory access.
==77298==Hint: address points to the zero page.
    0 0x7fdac6d7d40e in fuse_session_destroy (/usr/lib64/libfuse3.so.3+0x1640e)
    1 0x40dc7a in cuse_nvme_ns_stop /home/vagrant/spdk_repo/spdk/lib/nvme/nvme_cuse.c:851
    2 0x40df59 in cuse_nvme_ctrlr_stop /home/vagrant/spdk_repo/spdk/lib/nvme/nvme_cuse.c:923
    3 0x40f103 in nvme_cuse_stop /home/vagrant/spdk_repo/spdk/lib/nvme/nvme_cuse.c:1094
    4 0x415803 in test_nvme_cuse_stop /home/vagrant/spdk_repo/spdk/test/unit/lib/nvme/nvme_cuse.c/nvme_cuse_ut.c:393
    5 0x7fdac724c1a6  (/usr/lib64/libcunit.so.1+0x41a6)
    6 0x7fdac724c528  (/usr/lib64/libcunit.so.1+0x4528)
    7 0x7fdac724d456 in CU_run_all_tests (/usr/lib64/libcunit.so.1+0x5456)
    8 0x415a4e in main /home/vagrant/spdk_repo/spdk/test/unit/lib/nvme/nvme_cuse.c/nvme_cuse_ut.c:415
    9 0x7fdac62351e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)
    10 0x403ddd in _start (/home/vagrant/spdk_repo/spdk/test/unit/lib/nvme/nvme_cuse.c/nvme_cuse_ut+0x403ddd)

The fix is to call fuse_session_destroy() only if the fuse session is != NULL.

Signed-off-by: Sylvain Didelot <sdidelot@ddn.com>
Change-Id: I41881243227d83e8d1e6b90e72c1b6d62ccd98d3
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/10225
Community-CI: Mellanox Build Bot
Community-CI: Broadcom CI <spdk-ci.pdl@broadcom.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Aleksey Marchuk <alexeymar@mellanox.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
2021-11-17 10:58:50 +00:00
..
Makefile nvme: asynchronous create io qpair 2021-08-13 07:27:07 +00:00
nvme_ctrlr_cmd.c nvme: rename nvme_qpair_abort_reqs to *_with_cbarg 2021-09-22 06:55:28 +00:00
nvme_ctrlr_ocssd_cmd.c nvme: Move nsdata to namespace structure 2021-03-02 08:06:15 +00:00
nvme_ctrlr.c nvme: Do not construct the namespace object on ns_create 2021-11-15 11:59:59 +00:00
nvme_cuse.c nvme_cuse: Fix NULL pointer dereference triggered by unit test 2021-11-17 10:58:50 +00:00
nvme_cuse.h lib/nvme: add RPC for interacting with CUSE devices 2019-10-24 23:43:59 +00:00
nvme_fabric.c nvme/fabric: implement async register get/set functions 2021-09-16 07:16:52 +00:00
nvme_internal.h nvme: Rename max_active_ns_idx to active_ns_count 2021-11-15 11:59:59 +00:00
nvme_io_msg.c nvme: only process io_msg in primary process 2021-04-22 01:06:02 +00:00
nvme_io_msg.h lib/nvme: update io msg producers on ns manage 2020-06-05 09:01:44 +00:00
nvme_ns_cmd.c nvme: Add functions spdk_nvme_ns_cmd_readv/writev_ext 2021-08-20 07:26:10 +00:00
nvme_ns_ocssd_cmd.c nvme: save separate metadata size to nvme request 2020-04-02 07:02:38 +00:00
nvme_ns.c util: Add macro SPDK_SIZEOF_MEMBER to get size of a member of a struct 2021-07-15 07:16:22 +00:00
nvme_opal_internal.h nvme/opal: deprecate spdk_opal_supported() 2020-05-20 14:16:44 +00:00
nvme_opal.c nvme/opal: don't print error log for dirves that don't support OPAL 2021-11-12 01:01:28 +00:00
nvme_pcie_common.c nvme/pcie: only set qpair state from qpair's thread 2021-10-25 19:53:14 +00:00
nvme_pcie_internal.h nvme: add spdk_nvme_ctrlr_prepare_for_reset() 2021-09-07 07:33:41 +00:00
nvme_pcie.c nvme: Fix remove event processing bug 2021-07-13 09:07:23 +00:00
nvme_poll_group.c nvme: Add functions to get/free poll group statistics 2021-04-13 21:30:52 +00:00
nvme_qpair.c nvme: abort queued admin requests during init 2021-09-24 07:38:57 +00:00
nvme_quirks.c nvme: add DELAY_BEFORE_INIT quirk to Intel 0x0A54 SSD 2021-11-15 11:59:14 +00:00
nvme_rdma.c dma: Update translation result to hold iovec pointer 2021-10-20 22:55:52 +00:00
nvme_tcp.c nvme/tcp: Fix tcp_req->datao calculation issue. 2021-09-27 10:53:04 +00:00
nvme_transport.c nvme: Update spdk_nvme_ctrlr_get_memory_domain 2021-09-24 07:37:45 +00:00
nvme_vfio_user.c nvme/vfio-user: use the common request submission function 2021-06-09 07:21:31 +00:00
nvme_zns.c lib/nvme: NVMe ZNS - Zone Descriptor Extension support 2021-09-16 07:21:40 +00:00
nvme.c nvme: store fabrics connect data ptr in status structure 2021-08-31 08:38:16 +00:00
spdk_nvme.map nvme: Update spdk_nvme_ctrlr_get_memory_domain 2021-09-24 07:37:45 +00:00