libnvme: examples: bound device-supplied lengths in mi-mctp, fix ssid print - #3919
Open
prabhakarpujeri wants to merge 1 commit into
Open
libnvme: examples: bound device-supplied lengths in mi-mctp, fix ssid print#3919prabhakarpujeri wants to merge 1 commit into
prabhakarpujeri wants to merge 1 commit into
Conversation
… print Port of linux-nvme/libnvme#1140: - do_controllers() iterates le16_to_cpu(ctrl_list.num) entries of ctrl_list.identifier[]; num is 16-bit while the array holds NVME_ID_CTRL_LIST_MAX entries. Clamp with a warning. - do_security_info() validates n_proto against data_len (which covers the whole 264-byte buffer), not against protocols[256]; reject oversized counts. - print ctrl.ssid instead of ctrl.ssvid for the PCI subsystem device ID. Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Port of linux-nvme/libnvme#1140. Same three issues as the 1.x example:
do_controllers()iteratesle16_to_cpu(ctrl_list.num)entries ofctrl_list.identifier[];numis 16-bit while the array holdsNVME_ID_CTRL_LIST_MAX(2047) entries. A non-conformant device reporting more than that makes the loop read ~63 KB past the array and issue thousands of spurious MI transactions.do_security_info()validatesn_protoagainstdata_len(covering the whole 264-byte buffer) rather thanprotocols[256], so a full-length response can pass with counts of 257-258 → the print loop reads past the array.show_ctrl()printsctrl.ssvid(vendor ID) a second time for "PCI subsys device" instead ofctrl.ssid.Fix
Clamp the controller count with a warning; reject oversized
n_proto; printctrl.ssid.Testing