[PATCH] nvmet: check sscanf value for subsys serial attr

[PATCH] nvmet: check sscanf value for subsys serial attr

[Chaitanya Kulkarni]

For nvmet in configfs.c we check return values for all the sscanf()
calls. Add similar check into the nvmet_subsys_attr_serial_store().

Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
---
 drivers/nvme/target/configfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 98613a45bd3b..cc1fd36bf71e 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -853,12 +853,14 @@ static ssize_t nvmet_subsys_attr_serial_store(struct config_item *item,
 					      const char *page, size_t count)
 {
 	struct nvmet_subsys *subsys = to_subsys(item);
+	int ret = 0;
 
 	down_write(&nvmet_config_sem);
-	sscanf(page, "%llx\n", &subsys->serial);
+	if (sscanf(page, "%llx\n", &subsys->serial) != 1)
+		ret = -EINVAL;
 	up_write(&nvmet_config_sem);
 
-	return count;
+	return ret ? ret : count;
 }
 CONFIGFS_ATTR(nvmet_subsys_, attr_serial);
 
-- 
2.22.1


_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

Re: [PATCH] nvmet: check sscanf value for subsys serial attr

[Christoph Hellwig]

On Thu, Nov 21, 2019 at 12:31:42PM -0800, Chaitanya Kulkarni wrote:
> For nvmet in configfs.c we check return values for all the sscanf()
> calls. Add similar check into the nvmet_subsys_attr_serial_store().
> 
> Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
> ---
>  drivers/nvme/target/configfs.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
> index 98613a45bd3b..cc1fd36bf71e 100644
> --- a/drivers/nvme/target/configfs.c
> +++ b/drivers/nvme/target/configfs.c
> @@ -853,12 +853,14 @@ static ssize_t nvmet_subsys_attr_serial_store(struct config_item *item,
>  					      const char *page, size_t count)
>  {
>  	struct nvmet_subsys *subsys = to_subsys(item);
> +	int ret = 0;
>  
>  	down_write(&nvmet_config_sem);
> -	sscanf(page, "%llx\n", &subsys->serial);
> +	if (sscanf(page, "%llx\n", &subsys->serial) != 1)
> +		ret = -EINVAL;
>  	up_write(&nvmet_config_sem);
>  
> -	return count;
> +	return ret ? ret : count;

So the problem is that we've already possible corrupted subsys->serial
when an error occurs.  So I think we need a local variable to sscan
in, return an error if that fails and only if it succeeds take the lock
and assign it to subsys->serial.

_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

Re: [PATCH] nvmet: check sscanf value for subsys serial attr

[Chaitanya Kulkarni]

> So the problem is that we've already possible corrupted subsys->serial
> when an error occurs.  So I think we need a local variable to sscan
> in, return an error if that fails and only if it succeeds take the lock
> and assign it to subsys->serial.
>
Okay, I'll send the V2.


_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme