]> git.dujemihanovic.xyz Git - linux.git/commit
nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
authorDan Carpenter <dan.carpenter@linaro.org>
Wed, 8 May 2024 07:43:04 +0000 (10:43 +0300)
committerKeith Busch <kbusch@kernel.org>
Wed, 8 May 2024 13:10:32 +0000 (06:10 -0700)
commitd15dcd0f1a4753b57e66c64c8dc2a9779ff96aab
treeb6ef5586d69d3a2bd76a2047aac91105e14d47d0
parent34cfb09cdc75457a671279165a88a0739a170f07
nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()

The nsid value is a u32 that comes from nvmet_req_find_ns().  It's
endian data and we're on an error path and both of those raise red
flags.  So let's make this safer.

1) Make the buffer large enough for any u32.
2) Remove the unnecessary initialization.
3) Use snprintf() instead of sprintf() for even more safety.
4) The sprintf() function returns the number of bytes printed, not
   counting the NUL terminator. It is impossible for the return value to
   be <= 0 so delete that.

Fixes: 505363957fad ("nvmet: fix nvme status code when namespace is disabled")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
drivers/nvme/target/configfs.c