Arnd Bergmann 6038aa532a nvme: target: fix buffer overflow ... nvmet_execute_get_disc_log_page() passes a fixed-length string into nvmet_format_discovery_entry(), which then does a longer memcpy() on it, as pointed out by gcc-8: In function 'nvmet_format_discovery_entry', inlined from 'nvmet_execute_get_disc_log_page' at drivers/nvme/target/discovery.c:126:4: drivers/nvme/target/discovery.c:62:2: error: 'memcpy' forming offset [38, 223] is out of the bounds [0, 37] [-Werror=array-bounds] memcpy(e->subnqn, subsys_nqn, NVMF_NQN_SIZE); Using strncpy() will make this well-defined, filling the rest of the buffer with zeroes, under the assumption that the input is either a NUL-terminated string, or a byte sequence containing no zeroes. If the input is a string that is longer than NVMF_NQN_SIZE, we continue to have no NUL-termination in the output. Fixes: a07b4970f4 ("nvmet: add a generic NVMe target") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <keith.busch@intel.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>		2018-04-12 09:58:27 -06:00
..
host	nvme: don't send keep-alives to the discovery controller	2018-04-12 09:58:27 -06:00
target	nvme: target: fix buffer overflow	2018-04-12 09:58:27 -06:00
Kconfig	nvme: use menu Kconfig interface	2017-10-04 09:43:57 +02:00
Makefile	nvmet: add a generic NVMe target	2016-07-05 11:30:33 -06:00