github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nvme: validate FDP configuration descriptor sizes

Browse Source 
Validate descriptor sizes while walking the FDP configurations log so
dsze == 0 or a descriptor past the log end cannot cause unbounded
iteration or reads past the buffer.

Reviewed-by: Nitesh Shetty <nj.shetty@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: liuxixin <gliuxen@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
This commit is contained in:
liuxixin 2026-06-02 22:00:01 +08:00 committed by Keith Busch
parent 3a413ece25
commit 0ef4daa653
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/nvme/host/core.c
View File

@ -2273,14 +2273,16 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
desc = log;
end = log + size - sizeof(*h);
for (i = 0; i < fdp_idx; i++) {
log += le16_to_cpu(desc->dsze);
desc = log;
if (log >= end) {
u16 dsze = le16_to_cpu(desc->dsze);
if (!dsze || log + dsze > end) {
dev_warn(ctrl->device,
"FDP invalid config descriptor list\n");
"FDP invalid config descriptor at index %d\n", i);
ret = 0;
goto out;
}
log += dsze;
desc = log;
}
if (le32_to_cpu(desc->nrg) > 1) {