Messages in this thread Patch in this message | | | From | Tuo Li <> | Subject | [PATCH] lightnvm: fix possible uninitialized-variable access in nvme_nvm_submit_user_cmd() | Date | Sat, 31 Jul 2021 00:30:42 -0700 |
| |
The variable metadata_dma is not initialized at the beginning of the function nvme_nvm_submit_user_cmd(). If the parameter ubuf is NULL, it remains uninitialized at the label err_meta. However, it is accessed through the function dma_pool_free() if meta_buf is not NULL and meta_len is not zero. In fact, ubuf, meta_buf and meta_len can come from user space which indicates this can happen.
To fix this possible bug, only when ubuf and meta_buf are not NULL, and bufflen and meta_len are not zero, the function dma_pool_free() is called.
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Tuo Li <islituo@gmail.com> --- drivers/nvme/host/lightnvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c index e9d9ad47f70f..3d9fd098bd83 100644 --- a/drivers/nvme/host/lightnvm.c +++ b/drivers/nvme/host/lightnvm.c @@ -835,7 +835,7 @@ static int nvme_nvm_submit_user_cmd(struct request_queue *q, ret = -EFAULT; } err_meta: - if (meta_buf && meta_len) + if (ubuf && bufflen && meta_buf && meta_len) dma_pool_free(dev->dma_pool, metadata, metadata_dma); err_map: if (bio) -- 2.25.1
| |