diff options
| author | liuxixin <gliuxen@gmail.com> | 2026-06-02 22:00:01 +0800 |
|---|---|---|
| committer | Keith Busch <kbusch@kernel.org> | 2026-06-03 02:42:07 -0700 |
| commit | 0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8 (patch) | |
| tree | 00cdea4929faa189cd6df1ee50871fac44d37d4e | |
| parent | 3a413ece2504c70aa34a20be4dafec04e8c741f9 (diff) | |
| download | linux-stable-0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8.tar.gz linux-stable-0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8.zip | |
nvme: validate FDP configuration descriptor sizes
Validate descriptor sizes while walking the FDP configurations log so
dsze == 0 or a descriptor past the log end cannot cause unbounded
iteration or reads past the buffer.
Reviewed-by: Nitesh Shetty <nj.shetty@samsung.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: liuxixin <gliuxen@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
| -rw-r--r-- | drivers/nvme/host/core.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index cad9d9735261..23dfce27ace2 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -2273,14 +2273,16 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl, desc = log; end = log + size - sizeof(*h); for (i = 0; i < fdp_idx; i++) { - log += le16_to_cpu(desc->dsze); - desc = log; - if (log >= end) { + u16 dsze = le16_to_cpu(desc->dsze); + + if (!dsze || log + dsze > end) { dev_warn(ctrl->device, - "FDP invalid config descriptor list\n"); + "FDP invalid config descriptor at index %d\n", i); ret = 0; goto out; } + log += dsze; + desc = log; } if (le32_to_cpu(desc->nrg) > 1) { |