Commit 4db3d750 authored by Leo Stone's avatar Leo Stone Committed by Keith Busch
Browse files

nvmet: Don't overflow subsysnqn 



nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed
size buffer, even though it is dynamically allocated to the size of the
string.

Create a new string with kstrndup instead of using the old buffer.

Reported-by: default avatar <syzbot+ff4aab278fa7e27e0f9e@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=ff4aab278fa7e27e0f9e


Fixes: 95409e27 ("nvmet: implement unique discovery NQN")
Signed-off-by: default avatarLeo Stone <leocstone@gmail.com>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent ebefac56

drivers/nvme/target/configfs.c

+9 −2
Original line number Diff line number Diff line
@@ -2254,12 +2254,17 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item, 
		const char *page, size_t count)

{

	struct list_head *entry;

	char *old_nqn, *new_nqn;

	size_t len;



	len = strcspn(page, "\n");

	if (!len || len > NVMF_NQN_FIELD_LEN - 1)

		return -EINVAL;



	new_nqn = kstrndup(page, len, GFP_KERNEL);

	if (!new_nqn)

		return -ENOMEM;



	down_write(&nvmet_config_sem);

	list_for_each(entry, &nvmet_subsystems_group.cg_children) {

		struct config_item *item =
@@ -2268,13 +2273,15 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item, 
		if (!strncmp(config_item_name(item), page, len)) {

			pr_err("duplicate NQN %s\n", config_item_name(item));

			up_write(&nvmet_config_sem);

			kfree(new_nqn);

			return -EINVAL;

		}

	}

	memset(nvmet_disc_subsys->subsysnqn, 0, NVMF_NQN_FIELD_LEN);

	memcpy(nvmet_disc_subsys->subsysnqn, page, len);

	old_nqn = nvmet_disc_subsys->subsysnqn;

	nvmet_disc_subsys->subsysnqn = new_nqn;

	up_write(&nvmet_config_sem);



	kfree(old_nqn);

	return len;

}