Skip to content
Commit cb8563f5 authored by Sagi Grimberg's avatar Sagi Grimberg Committed by Christoph Hellwig
Browse files

nvmet-tcp: fix out-of-bounds access when receiving multiple h2cdata PDUs



When the host sends multiple h2cdata PDUs, we keep track on
the receive progress and calculate the scatterlist index and
offsets.

The issue is that sg_offset should only be kept for the first
iov entry we map in the iovec as this is the difference between
our cursor and the sg entry offset itself.

In addition, the sg index was calculated wrong because we should
not round up when dividing the command byte offset with PAG_SIZE.

Fixes: 872d26a3 ("nvmet-tcp: add NVMe over TCP target driver")
Reported-by: default avatarNarayan Ayalasomayajula <Narayan.Ayalasomayajula@wdc.com>
Tested-by: default avatarNarayan Ayalasomayajula <Narayan.Ayalasomayajula@wdc.com>
Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 46121fa7
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment