From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 11 Feb 2022 11:38:53 +0000 (+0100)
Subject: 5.4-stable patches
X-Git-Tag: v4.9.302~59
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b1e069b5b2242f6aa926abfa3cf59068333fd3b9;p=thirdparty%2Fkernel%2Fstable-queue.git

5.4-stable patches

added patches:
	nvme-fix-parsing-of-ana-log-page.patch
---

diff --git a/queue-5.4/nvme-fix-parsing-of-ana-log-page.patch b/queue-5.4/nvme-fix-parsing-of-ana-log-page.patch
new file mode 100644
index 00000000000..1882efc4a9f
--- /dev/null
+++ b/queue-5.4/nvme-fix-parsing-of-ana-log-page.patch
@@ -0,0 +1,51 @@
+From 64fab7290dc3561729bbc1e35895a517eb2e549e Mon Sep 17 00:00:00 2001
+From: Prabhath Sajeepa <psajeepa@purestorage.com>
+Date: Mon, 28 Oct 2019 16:56:48 -0600
+Subject: nvme: Fix parsing of ANA log page
+
+From: Prabhath Sajeepa <psajeepa@purestorage.com>
+
+commit 64fab7290dc3561729bbc1e35895a517eb2e549e upstream.
+
+Check validity of offset into ANA log buffer before accessing
+nvme_ana_group_desc. This check ensures the size of ANA log buffer >=
+offset + sizeof(nvme_ana_group_desc)
+
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Prabhath Sajeepa <psajeepa@purestorage.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Uday Shankar <ushankar@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/multipath.c |   12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -458,8 +458,14 @@ static int nvme_parse_ana_log(struct nvm
+ 
+ 	for (i = 0; i < le16_to_cpu(ctrl->ana_log_buf->ngrps); i++) {
+ 		struct nvme_ana_group_desc *desc = base + offset;
+-		u32 nr_nsids = le32_to_cpu(desc->nnsids);
+-		size_t nsid_buf_size = nr_nsids * sizeof(__le32);
++		u32 nr_nsids;
++		size_t nsid_buf_size;
++
++		if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc)))
++			return -EINVAL;
++
++		nr_nsids = le32_to_cpu(desc->nnsids);
++		nsid_buf_size = nr_nsids * sizeof(__le32);
+ 
+ 		if (WARN_ON_ONCE(desc->grpid == 0))
+ 			return -EINVAL;
+@@ -479,8 +485,6 @@ static int nvme_parse_ana_log(struct nvm
+ 			return error;
+ 
+ 		offset += nsid_buf_size;
+-		if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc)))
+-			return -EINVAL;
+ 	}
+ 
+ 	return 0;
diff --git a/queue-5.4/series b/queue-5.4/series
index 11badd5bcda..f2232f7de47 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -8,3 +8,4 @@ net-phy-marvell-fix-mdi-x-polarity-setting-in-88e1118-compatible-phys.patch
 nfs-fix-initialisation-of-nfs_client-cl_flags-field.patch
 nfsd-clamp-write-offsets.patch
 nfsd-fix-offset-type-in-i-o-trace-points.patch
+nvme-fix-parsing-of-ana-log-page.patch