* [PATCHv2] nvme: sanitize metadata bounce buffer for reads
@ 2023-10-16 23:06 ` Keith Busch
2023-10-17 1:14 ` Jens Axboe
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Keith Busch @ 2023-10-16 23:06 UTC (permalink / raw)
To: hch, linux-nvme; +Cc: sagi, axboe, Keith Busch
From: Keith Busch <kbusch@kernel.org>
User can request more metadata bytes than the device will write. Ensure
kernel buffer is initialized so we are not leaking unsanitized memory on
the completion's copy-out.
Fixes: 0b7f1f26f95a51a ("nvme: use the block layer for userspace passthrough metadata")
Signed-off-by: Keith Busch <kbusch@kernel.org>
---
v1->v2:
correctly split data direction handling (axboe)
drivers/nvme/host/ioctl.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index 788b36e7915ab..eb2ef3e149614 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -36,9 +36,13 @@ static void *nvme_add_user_metadata(struct request *req, void __user *ubuf,
if (!buf)
goto out;
- ret = -EFAULT;
- if ((req_op(req) == REQ_OP_DRV_OUT) && copy_from_user(buf, ubuf, len))
- goto out_free_meta;
+ if (req_op(req) == REQ_OP_DRV_OUT) {
+ ret = -EFAULT;
+ if (copy_from_user(buf, ubuf, len))
+ goto out_free_meta;
+ } else {
+ memset(buf, 0, len);
+ }
bip = bio_integrity_alloc(bio, GFP_KERNEL, 1);
if (IS_ERR(bip)) {
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCHv2] nvme: sanitize metadata bounce buffer for reads
2023-10-16 23:06 ` [PATCHv2] nvme: sanitize metadata bounce buffer for reads Keith Busch
@ 2023-10-17 1:14 ` Jens Axboe
2023-10-17 4:17 ` Christoph Hellwig
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Jens Axboe @ 2023-10-17 1:14 UTC (permalink / raw)
To: Keith Busch, hch, linux-nvme; +Cc: sagi, Keith Busch
On 10/16/23 5:06 PM, Keith Busch wrote:
> From: Keith Busch <kbusch@kernel.org>
>
> User can request more metadata bytes than the device will write. Ensure
> kernel buffer is initialized so we are not leaking unsanitized memory on
> the completion's copy-out.
>
> Fixes: 0b7f1f26f95a51a ("nvme: use the block layer for userspace passthrough metadata")
> Signed-off-by: Keith Busch <kbusch@kernel.org>
> ---
> v1->v2:
>
> correctly split data direction handling (axboe)
>
> drivers/nvme/host/ioctl.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
> index 788b36e7915ab..eb2ef3e149614 100644
> --- a/drivers/nvme/host/ioctl.c
> +++ b/drivers/nvme/host/ioctl.c
> @@ -36,9 +36,13 @@ static void *nvme_add_user_metadata(struct request *req, void __user *ubuf,
> if (!buf)
> goto out;
>
> - ret = -EFAULT;
> - if ((req_op(req) == REQ_OP_DRV_OUT) && copy_from_user(buf, ubuf, len))
> - goto out_free_meta;
> + if (req_op(req) == REQ_OP_DRV_OUT) {
> + ret = -EFAULT;
> + if (copy_from_user(buf, ubuf, len))
> + goto out_free_meta;
> + } else {
> + memset(buf, 0, len);
> + }
>
> bip = bio_integrity_alloc(bio, GFP_KERNEL, 1);
> if (IS_ERR(bip)) {
Reviewed-by: Jens Axboe <axboe@kernel.dk>
--
Jens Axboe
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCHv2] nvme: sanitize metadata bounce buffer for reads
2023-10-16 23:06 ` [PATCHv2] nvme: sanitize metadata bounce buffer for reads Keith Busch
2023-10-17 1:14 ` Jens Axboe
@ 2023-10-17 4:17 ` Christoph Hellwig
2023-10-17 6:06 ` Kanchan Joshi
2023-10-17 8:22 ` Chaitanya Kulkarni
3 siblings, 0 replies; 5+ messages in thread
From: Christoph Hellwig @ 2023-10-17 4:17 UTC (permalink / raw)
To: Keith Busch; +Cc: hch, linux-nvme, sagi, axboe, Keith Busch
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCHv2] nvme: sanitize metadata bounce buffer for reads
2023-10-16 23:06 ` [PATCHv2] nvme: sanitize metadata bounce buffer for reads Keith Busch
2023-10-17 1:14 ` Jens Axboe
2023-10-17 4:17 ` Christoph Hellwig
@ 2023-10-17 6:06 ` Kanchan Joshi
2023-10-17 8:22 ` Chaitanya Kulkarni
3 siblings, 0 replies; 5+ messages in thread
From: Kanchan Joshi @ 2023-10-17 6:06 UTC (permalink / raw)
To: Keith Busch, hch, linux-nvme; +Cc: sagi, axboe, Keith Busch
On 10/17/2023 4:36 AM, Keith Busch wrote:
> From: Keith Busch <kbusch@kernel.org>
>
> User can request more metadata bytes than the device will write. Ensure
> kernel buffer is initialized so we are not leaking unsanitized memory on
> the completion's copy-out.
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCHv2] nvme: sanitize metadata bounce buffer for reads
2023-10-16 23:06 ` [PATCHv2] nvme: sanitize metadata bounce buffer for reads Keith Busch
` (2 preceding siblings ...)
2023-10-17 6:06 ` Kanchan Joshi
@ 2023-10-17 8:22 ` Chaitanya Kulkarni
3 siblings, 0 replies; 5+ messages in thread
From: Chaitanya Kulkarni @ 2023-10-17 8:22 UTC (permalink / raw)
To: Keith Busch, linux-nvme@lists.infradead.org
Cc: sagi@grimberg.me, axboe@kernel.dk, hch@lst.de, Keith Busch
On 10/16/23 16:06, Keith Busch wrote:
> From: Keith Busch <kbusch@kernel.org>
>
> User can request more metadata bytes than the device will write. Ensure
> kernel buffer is initialized so we are not leaking unsanitized memory on
> the completion's copy-out.
>
> Fixes: 0b7f1f26f95a51a ("nvme: use the block layer for userspace passthrough metadata")
> Signed-off-by: Keith Busch <kbusch@kernel.org>
> ---
>
V2 has a fix for comment posted on v1, looks good.
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
-ck
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-10-17 8:22 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CGME20231016230939epcas5p47d9b62301959586c168c9baca580c874@epcas5p4.samsung.com>
2023-10-16 23:06 ` [PATCHv2] nvme: sanitize metadata bounce buffer for reads Keith Busch
2023-10-17 1:14 ` Jens Axboe
2023-10-17 4:17 ` Christoph Hellwig
2023-10-17 6:06 ` Kanchan Joshi
2023-10-17 8:22 ` Chaitanya Kulkarni
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox