| From 2a9763de49d29a1460088fc3250163406a4d0b42 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 16 Oct 2020 15:33:51 +0100 |
| Subject: lightnvm: fix out-of-bounds write to array devices->info[] |
| |
| From: Colin Ian King <colin.king@canonical.com> |
| |
| [ Upstream commit a48faebe65b0db55a73b9220c3d919eee849bb79 ] |
| |
| There is an off-by-one array check that can lead to a out-of-bounds |
| write to devices->info[i]. Fix this by checking by using >= rather |
| than > for the size check. Also replace hard-coded array size limit |
| with ARRAY_SIZE on the array. |
| |
| Addresses-Coverity: ("Out-of-bounds write") |
| Fixes: cd9e9808d18f ("lightnvm: Support for Open-Channel SSDs") |
| Signed-off-by: Colin Ian King <colin.king@canonical.com> |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/lightnvm/core.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c |
| index fe78bf0fdce54..c1bcac71008c6 100644 |
| --- a/drivers/lightnvm/core.c |
| +++ b/drivers/lightnvm/core.c |
| @@ -1311,8 +1311,9 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg) |
| strlcpy(info->bmname, "gennvm", sizeof(info->bmname)); |
| i++; |
| |
| - if (i > 31) { |
| - pr_err("max 31 devices can be reported.\n"); |
| + if (i >= ARRAY_SIZE(devices->info)) { |
| + pr_err("max %zd devices can be reported.\n", |
| + ARRAY_SIZE(devices->info)); |
| break; |
| } |
| } |
| -- |
| 2.25.1 |
| |
