From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7560E3CC7F3 for ; Tue, 26 May 2026 07:52:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779781974; cv=none; b=fr3WZDwD2K+eqEx2MM6yXI8xLnEbnQ8hJ0ECvyOIsClZVdehPznurgkwkZdwTzaxJ92OG0yItINUTS5mxC5xAmUjFJ2un4ew01zZuxyRERQRGuJ2ZTg+pKfTba+m5KSq6BQ/2bqOqDisA+gRybKDwKgeNpec8N5UUKJBw1NAHmA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779781974; c=relaxed/simple; bh=htvVf3C716hpT0nhkKz1/ooMevyhNgFeI5DZkOr/qLs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=b9NI48LHoMR1I6A/gbi5ENvRYHvDDL10wzhiiBhxfL0WjByXV1Sa++Vi/BdwyMgrprRz+CumO6llZRNP3szv02QYF7m4TiOnGzI1Hz11PrTQbQO2i7ToJXOnF6+H4EqMgLf2zDPbNlhYDDt0DLgEQvpsSsSw3TPosvK894392/I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qLL7JKy1; arc=none smtp.client-ip=209.85.128.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qLL7JKy1" Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-49041e84237so31223605e9.1 for ; Tue, 26 May 2026 00:52:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779781962; x=1780386762; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=4w4YDVU9FCAe4woIXkwK7wnANjG8Ql/SZsjHSJVgUOk=; b=qLL7JKy1bDdYD/YTvVPaj8uOTiH0TFOVt84tdiglBCsh2uAdKMq8SziGt8LIxW2Mcy OZS/WOFMNM2vLZe9vnqExedaxuB9uqdqHi5EARh/ABMtDxb553vtrU19jJxehL3sDF8R fI8EnTr5GGeZV+9HO5cZK8TjqQEEnx5KjyX8e1jffbgxhlV5ylwLwftuvKZ2q4nUK/eb SJL6Harlmww887b5YU1Y8GJ0tFrr9m0cJAAo+2eOF8ybe5MazR93/oC95D9a3al45P+c Pr1Xp1rjQDPzL0QvFoZ1Z6vUm9Rjh/DwcN5gDan8cvxo6xOEPCvgml/sH0i0R+AX7xPW 7DLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779781962; x=1780386762; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=4w4YDVU9FCAe4woIXkwK7wnANjG8Ql/SZsjHSJVgUOk=; b=kBeTtyM+bi9kH9KTZRRxQVJ2GcY8zd1DPG8ezrvBDxi6qqQjbWFRM0gydPtZaS9ZaG mgoRtjTaIBQNkBMbIAnbaCZjVsrV5MxmRUZ2erOQPCQjOOk7yaLRBmmEbqKVUOwupp9D LwUCP5ZYtc725+6VvNuVbRjMYwy/IidhkqS+2xEUvRCw8JxgLY6XSGDbbVvE77TVDyFy 6P8Yj7xzPiHz5CF7930O8TocOf1hUAY+o/0kHOGHkR96T/VvRJSxyotLO7HR9g88llEr 5Tl+B02rNHofGSzU4YNgL/Nap06XRR++dBx+AZIl4R0ajVSYoCbXRMdHq7N4Lm6ftMI1 KX5w== X-Forwarded-Encrypted: i=1; AFNElJ9/UWJpGhMz+fDtu/0hPp3BEbIJp7sAddRsstOMkKjcUZOnTPFOb2jTgXev802pIAyBLmzFgEegYGU3UdI=@vger.kernel.org X-Gm-Message-State: AOJu0YyFr1drDeJUd6bnGaN/4tawUcxVcy2D0r77G80oi0p3cZ6hkcne C4esL1UsjMzVp2e6WBiJlMFcspfmRCUvhIrQYl3WdAlAsGYGDaxLbtNh X-Gm-Gg: Acq92OHuIQKBtWI8mkgVTuwgcGBlP4ra8qmnD0gvh8xwpgvz+tx/LX2lyz9KWxqpjIX wFMbhfRR0rhqy5CK0bJ+YtJDYUlB9KDomZqI5NBJRdLUQZKkf9ya5wiy9WkDbTMzbdNlHRsgef7 A7WpA93kd1EUrt6It6rnC3URvL9kP5Si7r9oDhNdzoIN7gmf4PuGISM+A0pBcBCPD29+zBJ0zBQ BI3eLhY/IJRPIfPs4+H2HmR1e6EL26fVTHjRuWXBb5zq9jTCkpOpXGyOPwWNyBOZ8HHWckLlFhR 6jxPEqyEnLsDvBqG3LVBWqSIc5rpZ6OoVV53UOWPLtUy2kCEkEMWt2AZ0TCU0g/RPQPOt8Yi90p v17A64GtuqllStEbxSb2JNibfXCbz6Vf/9K5mjDrxZX/KBUPLkrS8Y4a9Y4BtnW4XlLl/BzRdRV fLjXgzMLE= X-Received: by 2002:a05:600c:1d19:b0:48a:761:5816 with SMTP id 5b1f17b1804b1-4904245fe58mr245857735e9.8.1779781961488; Tue, 26 May 2026 00:52:41 -0700 (PDT) Received: from [127.0.1.1] ([2a09:bac5:3803:1cdc::2e0:83]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4904526c926sm540682825e9.1.2026.05.26.00.52.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 00:52:41 -0700 (PDT) From: liuxixin To: linux-nvme@lists.infradead.org Cc: kbusch@kernel.org, axboe@kernel.dk, hch@lst.de, sagi@grimberg.me, linux-kernel@vger.kernel.org Subject: [PATCH v1 1/1] nvme: fix FDP configuration log parsing Date: Tue, 26 May 2026 15:52:38 +0800 Message-ID: <177978195864.4106423.11658267582906445997@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Mailer: send-local.py NUMFDPC in the FDP Configurations log (NVMe Base Specification, Figure 279) is a 0-based count of configuration descriptors. Valid fdpcidx values are 0 through the NUMFDPC field value inclusive. Fix the off-by-one check which incorrectly accepts fdpcidx == NUMFDPC+1. Also validate descriptor sizes while walking the list so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer. Fixes: 30b5f20bb2ddab013035399e5c7e6577da49320a ("nvme: register fdp parameters with the block layer") Signed-off-by: liuxixin --- drivers/nvme/host/core.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index c3032d6ad..c5e77f5bc 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -2231,7 +2231,8 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl, struct nvme_fdp_config_desc *desc; size_t size = sizeof(hdr); void *log, *end; - int i, n, ret; + int i, ret; + u16 numfdpc; ret = nvme_get_log_lsi(ctrl, 0, NVME_LOG_FDP_CONFIGS, 0, NVME_CSI_NVM, &hdr, size, 0, info->endgid); @@ -2262,10 +2263,10 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl, goto out; } - n = le16_to_cpu(h->numfdpc) + 1; - if (fdp_idx > n) { + numfdpc = le16_to_cpu(h->numfdpc); + if (fdp_idx > numfdpc) { dev_warn(ctrl->device, "FDP index:%d out of range:%d\n", - fdp_idx, n); + fdp_idx, numfdpc); /* Proceed without registering FDP streams */ ret = 0; goto out; @@ -2275,7 +2276,15 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl, desc = log; end = log + size - sizeof(*h); for (i = 0; i < fdp_idx; i++) { - log += le16_to_cpu(desc->dsze); + u16 dsze = le16_to_cpu(desc->dsze); + + if (!dsze || log + dsze > end) { + dev_warn(ctrl->device, + "FDP invalid config descriptor at index %d\n", i); + ret = 0; + goto out; + } + log += dsze; desc = log; if (log >= end) { dev_warn(ctrl->device, -- 2.43.0