diff options
| author | openeuler-ci-bot <george@openeuler.sh> | 2024-04-09 06:55:24 +0000 |
|---|---|---|
| committer | Gitee <noreply@gitee.com> | 2024-04-09 06:55:24 +0000 |
| commit | b5dba2222855381201f3a1a5def2d7ad6605523a (patch) | |
| tree | 9777d8388be114eb72ef7546e5ce15fe6994ccfb | |
| parent | 641a2239cc8d4b56ab8f9b3fb383cf736c0d8260 (diff) | |
| parent | 8c78d741c987d2079c9a16df17bb450718f52b74 (diff) | |
| download | openEuler-kernel-b5dba2222855381201f3a1a5def2d7ad6605523a.tar.gz | |
!5799 [sync] PR-5788: v2 Patches to Fix CVE-2023-52454
Merge Pull Request from: @openeuler-sync-bot
Origin pull request:
https://gitee.com/openeuler/kernel/pulls/5788
PR sync from: Wenyu Huang <huangwenyu5@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6ODYTTEQCMNUV22JH6YYDND2RGMQR7V4/
Maurizio Lombardi (2):
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU
length
nvmet-tcp: Fix the H2C expected PDU len calculation
--
2.34.1
https://gitee.com/src-openeuler/kernel/issues/I93ED1
Link:https://gitee.com/openeuler/kernel/pulls/5799
Reviewed-by: Zucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
| -rw-r--r-- | drivers/nvme/target/tcp.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 7ce22d173fc799..dc52372ed7b85e 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -18,6 +18,7 @@ #include "nvmet.h" #define NVMET_TCP_DEF_INLINE_DATA_SIZE (4 * PAGE_SIZE) +#define NVMET_TCP_MAXH2CDATA 0x400000 /* 16M arbitrary limit */ /* Define the socket priority to use for connections were it is desirable * that the NIC consider performing optimized packet processing or filtering. @@ -872,7 +873,7 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) icresp->hdr.pdo = 0; icresp->hdr.plen = cpu_to_le32(icresp->hdr.hlen); icresp->pfv = cpu_to_le16(NVME_TCP_PFV_1_0); - icresp->maxdata = cpu_to_le32(0x400000); /* 16M arbitrary limit */ + icresp->maxdata = cpu_to_le32(NVMET_TCP_MAXH2CDATA); icresp->cpda = 0; if (queue->hdr_digest) icresp->digest |= NVME_TCP_HDR_DIGEST_ENABLE; @@ -918,6 +919,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) { struct nvme_tcp_data_pdu *data = &queue->pdu.data; struct nvmet_tcp_cmd *cmd; + unsigned int exp_data_len; if (likely(queue->nr_cmds)) { if (unlikely(data->ttag >= queue->nr_cmds)) { @@ -941,7 +943,20 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) return -EPROTO; } + exp_data_len = le32_to_cpu(data->hdr.plen) - + nvmet_tcp_hdgst_len(queue) - + nvmet_tcp_ddgst_len(queue) - + sizeof(*data); + cmd->pdu_len = le32_to_cpu(data->data_length); + if (unlikely(cmd->pdu_len != exp_data_len || + cmd->pdu_len == 0 || + cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) { + pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len); + /* FIXME: use proper transport errors */ + nvmet_tcp_fatal_error(queue); + return -EPROTO; + } cmd->pdu_recv = 0; nvmet_tcp_map_pdu_iovec(cmd); queue->cmd = cmd; |