]> git.baikalelectronics.ru Git - kernel.git/commit
nvme: target: fix buffer overflow
authorArnd Bergmann <arnd@arndb.de>
Thu, 12 Apr 2018 15:16:07 +0000 (09:16 -0600)
committerJens Axboe <axboe@kernel.dk>
Thu, 12 Apr 2018 15:58:27 +0000 (09:58 -0600)
commit6f9c2cb584c359b4ca9ec50bc4fc5b5b1bb19e18
treeffb4f254e2d8a39ee400ea903e301a5b4aea269b
parente494ac312f745413ccd7cb9001ad00b2ff7484e6
nvme: target: fix buffer overflow

nvmet_execute_get_disc_log_page() passes a fixed-length string into
nvmet_format_discovery_entry(), which then does a longer memcpy() on
it, as pointed out by gcc-8:

In function 'nvmet_format_discovery_entry',
    inlined from 'nvmet_execute_get_disc_log_page' at drivers/nvme/target/discovery.c:126:4:
drivers/nvme/target/discovery.c:62:2: error: 'memcpy' forming offset [38, 223] is out of the bounds [0, 37] [-Werror=array-bounds]
  memcpy(e->subnqn, subsys_nqn, NVMF_NQN_SIZE);

Using strncpy() will make this well-defined, filling the rest of the
buffer with zeroes, under the assumption that the input is either
a NUL-terminated string, or a byte sequence containing no zeroes.
If the input is a string that is longer than NVMF_NQN_SIZE, we
continue to have no NUL-termination in the output.

Fixes: 7ffa682f8793 ("nvmet: add a generic NVMe target")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/nvme/target/discovery.c