diff options
| author | YunJe Shin <yjshin0438@gmail.com> | 2026-01-28 09:41:07 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-11 13:34:24 +0100 |
| commit | 043b4307a99f902697349128fde93b2ddde4686c (patch) | |
| tree | 22910a18a2767c3175650cec10683bec4edd66ca | |
| parent | 4298b01a29753f2d967b2506a8ce3fcd945a30c5 (diff) | |
| download | linux-043b4307a99f902697349128fde93b2ddde4686c.tar.gz linux-043b4307a99f902697349128fde93b2ddde4686c.tar.bz2 linux-043b4307a99f902697349128fde93b2ddde4686c.zip | |
nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
[ Upstream commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c ]
nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU
length or offset exceeds sg_cnt and then use bogus sg->length/offset
values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining
entries, and sg->length/offset before building the bvec.
Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Joonkyo Jung <joonkyoj@yonsei.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/nvme/target/tcp.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 6fd4f74315f6..b2c865282fd8 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -294,11 +294,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd) cmd->req.sg = NULL; } +static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue); + static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) { struct bio_vec *iov = cmd->iov; struct scatterlist *sg; u32 length, offset, sg_offset; + unsigned int sg_remaining; int nr_pages; length = cmd->pdu_len; @@ -306,17 +309,32 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) offset = cmd->rbytes_done; cmd->sg_idx = offset / PAGE_SIZE; sg_offset = offset % PAGE_SIZE; + if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } sg = &cmd->req.sg[cmd->sg_idx]; + sg_remaining = cmd->req.sg_cnt - cmd->sg_idx; while (length) { u32 iov_len = min_t(u32, length, sg->length - sg_offset); + if (!sg_remaining) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } + if (!sg->length || sg->length <= sg_offset) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } + iov->bv_page = sg_page(sg); iov->bv_len = sg->length; iov->bv_offset = sg->offset + sg_offset; length -= iov_len; sg = sg_next(sg); + sg_remaining--; iov++; sg_offset = 0; } |