Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 891c4ebf authored by Prabhath Sajeepa's avatar Prabhath Sajeepa Committed by Greg Kroah-Hartman
Browse files

nvme: Fix parsing of ANA log page 



commit 64fab7290dc3561729bbc1e35895a517eb2e549e upstream.

Check validity of offset into ANA log buffer before accessing
nvme_ana_group_desc. This check ensures the size of ANA log buffer >=
offset + sizeof(nvme_ana_group_desc)

Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarPrabhath Sajeepa <psajeepa@purestorage.com>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Cc: Uday Shankar <ushankar@purestorage.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d7d345c8

drivers/nvme/host/multipath.c

+8 −4
Original line number Diff line number Diff line
@@ -458,8 +458,14 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data, 


	for (i = 0; i < le16_to_cpu(ctrl->ana_log_buf->ngrps); i++) {

		struct nvme_ana_group_desc *desc = base + offset;

		u32 nr_nsids = le32_to_cpu(desc->nnsids);

		size_t nsid_buf_size = nr_nsids * sizeof(__le32);

		u32 nr_nsids;

		size_t nsid_buf_size;



		if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc)))

			return -EINVAL;



		nr_nsids = le32_to_cpu(desc->nnsids);

		nsid_buf_size = nr_nsids * sizeof(__le32);



		if (WARN_ON_ONCE(desc->grpid == 0))

			return -EINVAL;
@@ -479,8 +485,6 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data, 
			return error;



		offset += nsid_buf_size;

		if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc)))

			return -EINVAL;

	}



	return 0;