* [PATCH] nvmet: Don't overflow subsysnqn [not found] <6761b929.050a0220.29fcd0.0070.GAE@google.com> @ 2024-12-18 0:59 ` Leo Stone 2024-12-18 7:19 ` Christoph Hellwig 0 siblings, 1 reply; 2+ messages in thread From: Leo Stone @ 2024-12-18 0:59 UTC (permalink / raw) To: syzbot+ff4aab278fa7e27e0f9e, hch, sagi, kch Cc: linux-kernel, syzkaller-bugs, linux-nvme, Leo Stone nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed size buffer, even though it is dynamically allocated to the size of the string. Create a new string with kstrdup instead of using the old buffer. Reported-by: syzbot+ff4aab278fa7e27e0f9e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ff4aab278fa7e27e0f9e Fixes: 95409e277d83 ("nvmet: implement unique discovery NQN") Signed-off-by: Leo Stone <leocstone@gmail.com> --- drivers/nvme/target/configfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c index eeee9e9b854c..3fa25f9f7d92 100644 --- a/drivers/nvme/target/configfs.c +++ b/drivers/nvme/target/configfs.c @@ -2271,8 +2271,8 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item, return -EINVAL; } } - memset(nvmet_disc_subsys->subsysnqn, 0, NVMF_NQN_FIELD_LEN); - memcpy(nvmet_disc_subsys->subsysnqn, page, len); + kfree(nvmet_disc_subsys->subsysnqn); + nvmet_disc_subsys->subsysnqn = kstrdup(page, GFP_KERNEL); up_write(&nvmet_config_sem); return len; -- 2.43.0 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] nvmet: Don't overflow subsysnqn 2024-12-18 0:59 ` [PATCH] nvmet: Don't overflow subsysnqn Leo Stone @ 2024-12-18 7:19 ` Christoph Hellwig 0 siblings, 0 replies; 2+ messages in thread From: Christoph Hellwig @ 2024-12-18 7:19 UTC (permalink / raw) To: Leo Stone Cc: syzbot+ff4aab278fa7e27e0f9e, hch, sagi, kch, linux-kernel, syzkaller-bugs, linux-nvme On Tue, Dec 17, 2024 at 04:59:10PM -0800, Leo Stone wrote: > nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed > size buffer, even though it is dynamically allocated to the size of the > string. > > Create a new string with kstrdup instead of using the old buffer. > > Reported-by: syzbot+ff4aab278fa7e27e0f9e@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=ff4aab278fa7e27e0f9e > Fixes: 95409e277d83 ("nvmet: implement unique discovery NQN") > Signed-off-by: Leo Stone <leocstone@gmail.com> > --- > drivers/nvme/target/configfs.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c > index eeee9e9b854c..3fa25f9f7d92 100644 > --- a/drivers/nvme/target/configfs.c > +++ b/drivers/nvme/target/configfs.c > @@ -2271,8 +2271,8 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item, > return -EINVAL; > } > } > - memset(nvmet_disc_subsys->subsysnqn, 0, NVMF_NQN_FIELD_LEN); > - memcpy(nvmet_disc_subsys->subsysnqn, page, len); > + kfree(nvmet_disc_subsys->subsysnqn); > + nvmet_disc_subsys->subsysnqn = kstrdup(page, GFP_KERNEL); This needs error handling, pobably best done by using a local variable for the new allocation, which would also help to keep it outside the lock. ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-12-18 7:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <6761b929.050a0220.29fcd0.0070.GAE@google.com>
2024-12-18 0:59 ` [PATCH] nvmet: Don't overflow subsysnqn Leo Stone
2024-12-18 7:19 ` Christoph Hellwig
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox