mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 02:50:43 +00:00
nvmet-tcp: fix out-of-bounds access when receiving multiple h2cdata PDUs
When the host sends multiple h2cdata PDUs, we keep track on
the receive progress and calculate the scatterlist index and
offsets.
The issue is that sg_offset should only be kept for the first
iov entry we map in the iovec as this is the difference between
our cursor and the sg entry offset itself.
In addition, the sg index was calculated wrong because we should
not round up when dividing the command byte offset with PAG_SIZE.
Fixes: 872d26a391
("nvmet-tcp: add NVMe over TCP target driver")
Reported-by: Narayan Ayalasomayajula <Narayan.Ayalasomayajula@wdc.com>
Tested-by: Narayan Ayalasomayajula <Narayan.Ayalasomayajula@wdc.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
parent
46121fa7c2
commit
cb8563f5c7
1 changed files with 2 additions and 1 deletions
|
@ -305,7 +305,7 @@ static void nvmet_tcp_map_pdu_iovec(struct nvmet_tcp_cmd *cmd)
|
||||||
length = cmd->pdu_len;
|
length = cmd->pdu_len;
|
||||||
cmd->nr_mapped = DIV_ROUND_UP(length, PAGE_SIZE);
|
cmd->nr_mapped = DIV_ROUND_UP(length, PAGE_SIZE);
|
||||||
offset = cmd->rbytes_done;
|
offset = cmd->rbytes_done;
|
||||||
cmd->sg_idx = DIV_ROUND_UP(offset, PAGE_SIZE);
|
cmd->sg_idx = offset / PAGE_SIZE;
|
||||||
sg_offset = offset % PAGE_SIZE;
|
sg_offset = offset % PAGE_SIZE;
|
||||||
sg = &cmd->req.sg[cmd->sg_idx];
|
sg = &cmd->req.sg[cmd->sg_idx];
|
||||||
|
|
||||||
|
@ -318,6 +318,7 @@ static void nvmet_tcp_map_pdu_iovec(struct nvmet_tcp_cmd *cmd)
|
||||||
length -= iov_len;
|
length -= iov_len;
|
||||||
sg = sg_next(sg);
|
sg = sg_next(sg);
|
||||||
iov++;
|
iov++;
|
||||||
|
sg_offset = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
iov_iter_kvec(&cmd->recv_msg.msg_iter, READ, cmd->iov,
|
iov_iter_kvec(&cmd->recv_msg.msg_iter, READ, cmd->iov,
|
||||||
|
|
Loading…
Reference in a new issue