From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E2DE423147 for ; Thu, 9 Jul 2026 12:30:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783600240; cv=none; b=kZP1QA8y1KTSZh0D/7+DgoPkaPvGMCvX/+v3EiY9+B0Y8AGvhBOA4O5gikc6mlmPpt3dRskfx3i91YXNhJPy8gWahTfVvChVEdTukxVp8+njWcjbZamKp5ET/OwmlhvscZrJqkmpi6AvQ4ojlkuZczi6r/hk2IhXbcHVKrKD0HU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783600240; c=relaxed/simple; bh=qUff2+XtgbAIs4Ns0pE0zJDRyopy04ppgNw6YxxNW7w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hY4FRyPETu2WBB/ScyYn/u0ALJ4DYfKUcW/EqGL8AIpOcMcmyVJDUM+k6HD+6Qng4dtJzNEnflMw05GGNBzEzuRb7t4r21PRG8WFWtovluD6TWVJ7j9eehWqoOQScEFZL2BtqlUrN2Df+R5VCkU90AcMz3eUIMd2zZ91nHNyCCI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yCR6DlxM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yCR6DlxM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9F2E1F00A3F; Thu, 9 Jul 2026 12:30:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1783600239; bh=8ssAo0AR3mSCMO/CmbMqgkQmNZ819KECWYa6WDNvhE8=; h=From:To:Cc:Subject:Date; b=yCR6DlxMq8yyE3BcvnL5lUbZ/Jx9Yf2g2cqwXvKgNMHnALK4gj5p/lWWdwoeZZLkB pI3QBk3Xds5yxX8N09dlg0WrBjObUTwz8lfN/GDTcaDVrNY5H3ZGCWY3D3l8AZ1PB+ 2z+yaf6jLjpG0VNNtQPd6Lh+pln5LmYN8JZknrGY= From: Greg Kroah-Hartman To: linux-nvme@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Hari Mishal , Keith Busch , Jens Axboe , Christoph Hellwig , Sagi Grimberg , Greg Kroah-Hartman Subject: [PATCH 1/2] nvme: bound ns descriptor header and body to identify buffer Date: Thu, 9 Jul 2026 14:30:32 +0200 Message-ID: <2026070931-stopping-cost-239a@gregkh> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1415; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Xt5eXEL0N3t5nVlWvAruPNIVLqUfyhnCCxXQlx1s+3I=; b=owGbwMvMwCRo6H6F97bub03G02pJDFn+U9KtHXz9n023yjI65BLN9Oek/6Z3C4ot4mq1FvyJs rlkeCavI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbykIFhwbq41TFLslYuCrYw maa6PcbQ7DK/McP8XJ0ehXTe4Pm3nvgGrtVpN+RZudACAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Hari Mishal nvme_identify_ns_descs() allocates a buffer and gives it to the controller, which populates it and then iterates the buffer with variable byte increments that vary by type and body size. But, there is no bounds check inside the iteration itself except the loop bound itself. Fix this by checking and stopping iteration if the next header or its declared body would go past the buffer itself. Assisted-by: gkh_clanker_t1000 Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Signed-off-by: Hari Mishal Signed-off-by: Greg Kroah-Hartman --- drivers/nvme/host/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 453c1f0b2dd0..6505da5c5ebe 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -1583,8 +1583,12 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, for (pos = 0; pos < NVME_IDENTIFY_DATA_SIZE; pos += len) { struct nvme_ns_id_desc *cur = data + pos; + if (pos + sizeof(*cur) > NVME_IDENTIFY_DATA_SIZE) + break; if (cur->nidl == 0) break; + if (pos + sizeof(*cur) + cur->nidl > NVME_IDENTIFY_DATA_SIZE) + break; len = nvme_process_ns_desc(ctrl, &info->ids, cur, &csi_seen); if (len < 0) -- 2.55.0