• Arnd Bergmann's avatar
    nvme: target: fix buffer overflow · 6038aa53
    Arnd Bergmann authored
    nvmet_execute_get_disc_log_page() passes a fixed-length string into
    nvmet_format_discovery_entry(), which then does a longer memcpy() on
    it, as pointed out by gcc-8:
    
    In function 'nvmet_format_discovery_entry',
        inlined from 'nvmet_execute_get_disc_log_page' at drivers/nvme/target/discovery.c:126:4:
    drivers/nvme/target/discovery.c:62:2: error: 'memcpy' forming offset [38, 223] is out of the bounds [0, 37] [-Werror=array-bounds]
      memcpy(e->subnqn, subsys_nqn, NVMF_NQN_SIZE);
    
    Using strncpy() will make this well-defined, filling the rest of the
    buffer with zeroes, under the assumption that the input is either
    a NUL-terminated string, or a byte sequence containing no zeroes.
    If the input is a string that is longer than NVMF_NQN_SIZE, we
    continue to have no NUL-termination in the output.
    
    Fixes: a07b4970 ("nvmet: add a generic NVMe target")
    Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarKeith Busch <keith.busch@intel.com>
    Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
    6038aa53
discovery.c 6.69 KB