From: mwilck@suse.com
To: Keith Busch <kbusch@kernel.org>, Sagi Grimberg <sagi@grimberg.me>,
Chaitanya Kulkarni <Chaitanya.Kulkarni@wdc.com>,
Hannes Reinecke <hare@suse.de>
Cc: linux-nvme@lists.infradead.org,
Enzo Matsumiya <ematsumiya@suse.de>,
Martin Wilck <mwilck@suse.com>
Subject: [PATCH v2 9/9] fabrics: fix invalid memory access in discover_from_conf_file()
Date: Tue, 30 Mar 2021 17:57:11 +0200 [thread overview]
Message-ID: <20210330155711.8436-10-mwilck@suse.com> (raw)
In-Reply-To: <20210330155711.8436-1-mwilck@suse.com>
From: Martin Wilck <mwilck@suse.com>
argconfig_parse() assigns pointers in cfg to point to memory allocated
in all_args. If this memory is freed, these pointers become dangling.
This is particularly dangerous if discovery.conf contains empty lines,
comment lines, or invalid lines.
Fix it by setting all transport parameter to NULL after processing each
line, and not proceeding if the basic parameters aren't set.
Signed-off-by: Martin Wilck <mwilck@suse.com>
---
fabrics.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fabrics.c b/fabrics.c
index f9e5dc6..c9324bb 100644
--- a/fabrics.c
+++ b/fabrics.c
@@ -1506,6 +1506,9 @@ static int discover_from_conf_file(const char *desc, char *argstr,
if (err)
goto free_and_continue;
+ if (!cfg.transport || !cfg.traddr)
+ goto free_and_continue;
+
err = flags = validate_output_format(cfg.output_format);
if (err < 0)
goto free_and_continue;
@@ -1533,6 +1536,8 @@ static int discover_from_conf_file(const char *desc, char *argstr,
free_and_continue:
free(all_args);
free(argv);
+ cfg.transport = cfg.traddr = cfg.trsvcid =
+ cfg.host_traddr = NULL;
}
out:
--
2.30.1
_______________________________________________
Linux-nvme mailing list
Linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme
prev parent reply other threads:[~2021-03-30 16:02 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-30 15:57 [PATCH v2 0/9] Some minor fixes/additions for nvme-cli mwilck
2021-03-30 15:57 ` [PATCH v2 1/9] nvme-discover: lookup existing persistent controllers mwilck
2021-03-30 15:57 ` [PATCH v2 2/9] do_discover: free cfg.device when resetting it mwilck
2021-03-30 15:57 ` [PATCH v2 3/9] nvme-connect-all(1): fix documentation for --quiet/-S mwilck
2021-03-30 15:57 ` [PATCH v2 4/9] nvme: add some simplifying macros for __attribute__((cleanup())) mwilck
2021-03-30 15:57 ` [PATCH v2 5/9] nvme-cli: add generic logging functionality mwilck
2021-03-30 15:57 ` [PATCH v2 6/9] nvme: convert some function arguments from "char *" to "const char *" mwilck
2021-03-30 15:57 ` [PATCH v2 7/9] fabrics: use "const char *" in struct config mwilck
2021-03-30 15:57 ` [PATCH v2 8/9] fabrics: fix some memory leaks mwilck
2021-03-30 15:57 ` mwilck [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210330155711.8436-10-mwilck@suse.com \
--to=mwilck@suse.com \
--cc=Chaitanya.Kulkarni@wdc.com \
--cc=ematsumiya@suse.de \
--cc=hare@suse.de \
--cc=kbusch@kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=sagi@grimberg.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox