nvmet: Don't overflow subsysnqn

nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed
size buffer, even though it is dynamically allocated to the size of the
string.

Create a new string with kstrndup instead of using the old buffer.

Reported-by: syzbot+ff4aab278fa7e27e0f9e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ff4aab278fa7e27e0f9e
Fixes: 95409e277d83 ("nvmet: implement unique discovery NQN")
Signed-off-by: Leo Stone <leocstone@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index eeee9e9b854c12602d5a2939c3978ac492302949..9c109b93ffbf828459a38cbc57fa6acad780d6e3 100644 (file)
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -2254,12 +2254,17 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item,
                const char *page, size_t count)
 {
        struct list_head *entry;
+       char *old_nqn, *new_nqn;
        size_t len;
 
        len = strcspn(page, "\n");
        if (!len || len > NVMF_NQN_FIELD_LEN - 1)
                return -EINVAL;
 
+       new_nqn = kstrndup(page, len, GFP_KERNEL);
+       if (!new_nqn)
+               return -ENOMEM;
+
        down_write(&nvmet_config_sem);
        list_for_each(entry, &nvmet_subsystems_group.cg_children) {
                struct config_item *item =
@@ -2268,13 +2273,15 @@ static ssize_t nvmet_root_discovery_nqn_store(struct config_item *item,
                if (!strncmp(config_item_name(item), page, len)) {
                        pr_err("duplicate NQN %s\n", config_item_name(item));
                        up_write(&nvmet_config_sem);
+                       kfree(new_nqn);
                        return -EINVAL;
                }
        }
-       memset(nvmet_disc_subsys->subsysnqn, 0, NVMF_NQN_FIELD_LEN);
-       memcpy(nvmet_disc_subsys->subsysnqn, page, len);
+       old_nqn = nvmet_disc_subsys->subsysnqn;
+       nvmet_disc_subsys->subsysnqn = new_nqn;
        up_write(&nvmet_config_sem);
 
+       kfree(old_nqn);
        return len;
 }