Page MenuHomeFreeBSD
Files F177570673

D61575.1794768105.diff
No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

D61575.1794768105.diff
View Options

diff --git a/lib/libnvmf/nvmf_tcp.c b/lib/libnvmf/nvmf_tcp.c
--- a/lib/libnvmf/nvmf_tcp.c
+++ b/lib/libnvmf/nvmf_tcp.c
@@ -541,6 +541,7 @@
data_offset = le32toh(h2c->datao);
if (data_offset < cb->data_offset ||
+ data_offset > UINT32_MAX - data_len ||
data_offset + data_len > cb->data_offset + cb->data_len) {
nvmf_tcp_report_error(qp->qp.nq_association, qp,
NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_OUT_OF_RANGE, 0,
@@ -611,6 +612,7 @@
data_offset = le32toh(c2h->datao);
if (data_offset < cb->data_offset ||
+ data_offset > UINT32_MAX - data_len ||
data_offset + data_len > cb->data_offset + cb->data_len) {
nvmf_tcp_report_error(qp->qp.nq_association, qp,
NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_OUT_OF_RANGE, 0,
@@ -742,7 +744,7 @@
* out of range of the original command.
*/
data_len = le32toh(r2t->r2tl);
- if (data_offset + data_len > cb->data_len) {
+ if (data_len > cb->data_len - data_offset) {
nvmf_tcp_report_error(qp->qp.nq_association, qp,
NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_OUT_OF_RANGE, 0,
pdu->hdr, le32toh(pdu->hdr->plen), pdu->hdr->hlen);
diff --git a/sys/dev/nvmf/nvmf_tcp.c b/sys/dev/nvmf/nvmf_tcp.c
--- a/sys/dev/nvmf/nvmf_tcp.c
+++ b/sys/dev/nvmf/nvmf_tcp.c
@@ -698,6 +698,7 @@
data_offset = le32toh(h2c->datao);
if (data_offset < cb->data_offset ||
+ data_offset > UINT32_MAX - data_len ||
data_offset + data_len > cb->data_offset + cb->data_len) {
mtx_unlock(&qp->rx_buffers.lock);
nvmf_tcp_report_error(qp,
@@ -790,6 +791,7 @@
data_offset = le32toh(c2h->datao);
if (data_offset < cb->data_offset ||
+ data_offset > UINT32_MAX - data_len ||
data_offset + data_len > cb->data_offset + cb->data_len) {
mtx_unlock(&qp->rx_buffers.lock);
nvmf_tcp_report_error(qp,
@@ -973,7 +975,7 @@
* out of range of the original command.
*/
data_len = le32toh(r2t->r2tl);
- if (data_offset + data_len > cb->data_len) {
+ if (data_len > cb->data_len - data_offset) {
mtx_unlock(&qp->tx_buffers.lock);
nvmf_tcp_report_error(qp,
NVME_TCP_TERM_REQ_FES_DATA_TRANSFER_OUT_OF_RANGE, 0,

File Metadata

Mime Type
text/plain
Expires
Sun, Nov 15, 6:41 PM (23 h, 45 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41746827
Default Alt Text
D61575.1794768105.diff (2 KB)

Event Timeline