diff options
| author |   Christoph Hellwig <hch@lst.de> | 2015-05-08 18:00:26 +0200 |
|---|---|---|
| committer |   Jens Axboe <axboe@fb.com> | 2015-05-13 10:22:12 -0400 |
| commit | 3fd61b209977db8a9fe6c44d5a5a7aee7a255f64 (patch) | |
| tree | 424d48e7b77df6c569e516ca721d739726867434 | |
| parent | block: remove export for blk_queue_bio (diff) | |
| download | linux-dev-3fd61b209977db8a9fe6c44d5a5a7aee7a255f64.tar.xz linux-dev-3fd61b209977db8a9fe6c44d5a5a7aee7a255f64.zip | |
nvme: fix kernel memory corruption with short INQUIRY buffers
If userspace asks for an INQUIRY buffer smaller than 36 bytes, the SCSI
translation layer will happily write past the end of the INQUIRY buffer
allocation.
This is fairly easily reproducible by running the libiscsi test
suite and then starting an xfstests run.
Fixes: 4f1982 ("NVMe: Update SCSI Inquiry VPD 83h translation")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
| -rw-r--r-- | drivers/block/nvme-scsi.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/block/nvme-scsi.c b/drivers/block/nvme-scsi.c index 88f13c525712..44f2514fb775 100644 --- a/drivers/block/nvme-scsi.c +++ b/drivers/block/nvme-scsi.c @@ -2257,7 +2257,8 @@ static int nvme_trans_inquiry(struct nvme_ns *ns, struct sg_io_hdr *hdr, page_code = GET_INQ_PAGE_CODE(cmd); alloc_len = GET_INQ_ALLOC_LENGTH(cmd); - inq_response = kmalloc(alloc_len, GFP_KERNEL); + inq_response = kmalloc(max(alloc_len, STANDARD_INQUIRY_LENGTH), + GFP_KERNEL); if (inq_response == NULL) { res = -ENOMEM; goto out_mem; |