diff options
| author | Maurizio Lombardi <[email protected]> | 2025-02-26 13:42:18 +0000 |
|---|---|---|
| committer | Keith Busch <[email protected]> | 2025-02-28 02:19:08 +0000 |
| commit | ad95bab0cd28ed77c2c0d0b6e76e03e031391064 (patch) | |
| tree | 3ba360d1fb8d066eb2e1d8b587095d2e7de012cb /tools/testing/selftests/net/lib/py/utils.py | |
| parent | nvme-tcp: Fix a C2HTermReq error message (diff) | |
| download | kernel-ad95bab0cd28ed77c2c0d0b6e76e03e031391064.tar.gz kernel-ad95bab0cd28ed77c2c0d0b6e76e03e031391064.zip | |
nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
nvme_tcp_recv_pdu() doesn't check the validity of the header length.
When header digests are enabled, a target might send a packet with an
invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()
to access memory outside the allocated area and cause memory corruptions
by overwriting it with the calculated digest.
Fix this by rejecting packets with an unexpected header length.
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Signed-off-by: Maurizio Lombardi <[email protected]>
Reviewed-by: Sagi Grimberg <[email protected]>
Signed-off-by: Keith Busch <[email protected]>
Diffstat (limited to 'tools/testing/selftests/net/lib/py/utils.py')
0 files changed, 0 insertions, 0 deletions