5.4-stable patches

added patches:
	nvme-fix-parsing-of-ana-log-page.patch

diff --git a/queue-5.4/nvme-fix-parsing-of-ana-log-page.patch b/queue-5.4/nvme-fix-parsing-of-ana-log-page.patch
new file mode 100644 (file)
index 0000000..1882efc
--- /dev/null
+++ b/queue-5.4/nvme-fix-parsing-of-ana-log-page.patch
@@ -0,0 +1,51 @@
+From 64fab7290dc3561729bbc1e35895a517eb2e549e Mon Sep 17 00:00:00 2001
+From: Prabhath Sajeepa <psajeepa@purestorage.com>
+Date: Mon, 28 Oct 2019 16:56:48 -0600
+Subject: nvme: Fix parsing of ANA log page
+
+From: Prabhath Sajeepa <psajeepa@purestorage.com>
+
+commit 64fab7290dc3561729bbc1e35895a517eb2e549e upstream.
+
+Check validity of offset into ANA log buffer before accessing
+nvme_ana_group_desc. This check ensures the size of ANA log buffer >=
+offset + sizeof(nvme_ana_group_desc)
+
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Prabhath Sajeepa <psajeepa@purestorage.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Uday Shankar <ushankar@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/multipath.c |   12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -458,8 +458,14 @@ static int nvme_parse_ana_log(struct nvm
+ 
+       for (i = 0; i < le16_to_cpu(ctrl->ana_log_buf->ngrps); i++) {
+               struct nvme_ana_group_desc *desc = base + offset;
+-              u32 nr_nsids = le32_to_cpu(desc->nnsids);
+-              size_t nsid_buf_size = nr_nsids * sizeof(__le32);
++              u32 nr_nsids;
++              size_t nsid_buf_size;
++
++              if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc)))
++                      return -EINVAL;
++
++              nr_nsids = le32_to_cpu(desc->nnsids);
++              nsid_buf_size = nr_nsids * sizeof(__le32);
+ 
+               if (WARN_ON_ONCE(desc->grpid == 0))
+                       return -EINVAL;
+@@ -479,8 +485,6 @@ static int nvme_parse_ana_log(struct nvm
+                       return error;
+ 
+               offset += nsid_buf_size;
+-              if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc)))
+-                      return -EINVAL;
+       }
+ 
+       return 0;

diff --git a/queue-5.4/series b/queue-5.4/series
index 11badd5bcda9b94443074aa5b29c57e2f06782e8..f2232f7de47bd92c7f05cd158c7a4593cad52860 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -8,3 +8,4 @@ net-phy-marvell-fix-mdi-x-polarity-setting-in-88e1118-compatible-phys.patch
 nfs-fix-initialisation-of-nfs_client-cl_flags-field.patch
 nfsd-clamp-write-offsets.patch
 nfsd-fix-offset-type-in-i-o-trace-points.patch
+nvme-fix-parsing-of-ana-log-page.patch