tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

nvme: reject invalid pr_read_keys() num_keys values

The pr_read_keys() interface has a u32 num_keys parameter. The NVMe
Reservation Report command has a u32 maximum length. Reject num_keys
values that are too large to fit.

This will become important when pr_read_keys() is exposed to untrusted
userspace via an <linux/pr.h> ioctl.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Stefan Hajnoczi and committed by
Jens Axboe 38ec8469 ab4fb1d8

+5 -1
+5 -1
drivers/nvme/host/pr.c
··· 228 228 static int nvme_pr_read_keys(struct block_device *bdev, 229 229 struct pr_keys *keys_info) 230 230 { 231 - u32 rse_len, num_keys = keys_info->num_keys; 231 + size_t rse_len; 232 + u32 num_keys = keys_info->num_keys; 232 233 struct nvme_reservation_status_ext *rse; 233 234 int ret, i; 234 235 bool eds; ··· 239 238 * enough to get enough keys to fill the return keys buffer. 240 239 */ 241 240 rse_len = struct_size(rse, regctl_eds, num_keys); 241 + if (rse_len > U32_MAX) 242 + return -EINVAL; 243 + 242 244 rse = kzalloc(rse_len, GFP_KERNEL); 243 245 if (!rse) 244 246 return -ENOMEM;