libnvme: account for the appended spaces in libnvmf_get_entity_version() - #3918
Open
prabhakarpujeri wants to merge 1 commit into
Open
libnvme: account for the appended spaces in libnvmf_get_entity_version()#3918prabhakarpujeri wants to merge 1 commit into
prabhakarpujeri wants to merge 1 commit into
Conversation
Port of linux-nvme/libnvme#1136. read_file() keeps the num_bytes + bufsz == capacity invariant across its writes, but each of the three ' ' separators is appended without checking or decrementing bufsz. After the append the invariant is off by one; with proc files long enough to fill the buffer the next separator write lands one byte beyond the caller's allocation, and the following min(len, bufsz) memcpy still trusts the inflated bufsz. Guard the separator appends with bufsz and decrement as needed so the invariant holds, keeping the trailing memset in bounds too. Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Port of linux-nvme/libnvme#1136.
libnvmf_get_entity_version()rests on the invariantnum_bytes + bufsz == capacitymaintained byread_file(), but each of the three' 'separators is appended tobufferwithout checking or decrementingbufsz. After such an append the invariant is off by one, so with proc content long enough to fill the buffer the next separator lands one byte past the allocation, and the followingmin(len, bufsz)+memcpy()still trusts the inflatedbufsz(one more byte of overrun then).Fix
Guard the separator appends with
if (bufsz)and decrementbufszin step so the invariant holds, keeping the trailingmemset(&buffer[num_bytes], 0, bufsz)in bounds.Testing
/proc/sys/kernel/osreleasecontent so it is rare in practice, but the function's contract becomes provable.