Commit 8fbcc1e3 authored by Seth Howell's avatar Seth Howell Committed by Jim Harris
Browse files

nvme_ns_cmd: add overflow check in write_zeroes function 



The value for lba_count is stored in a 0-based 16 bit register. here we
confirm that the value passed to that register is no larger than 2^16.

Change-Id: I234e55fc2b61338444dfe8f734e76f958d1f0443
Signed-off-by: default avatarSeth Howell <seth.howell@intel.com>
Reviewed-on: https://review.gerrithub.io/372370


Tested-by: default avatarSPDK Automated Test System <sys_sgsw@intel.com>
Reviewed-by: default avatarDaniel Verkamp <daniel.verkamp@intel.com>
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
parent d8e88d99

lib/nvme/nvme_ns_cmd.c

+1 −1
Original line number Diff line number Diff line
@@ -714,7 +714,7 @@ spdk_nvme_ns_cmd_write_zeroes(struct spdk_nvme_ns *ns, struct spdk_nvme_qpair *q 
	struct spdk_nvme_cmd	*cmd;

	uint64_t		*tmp_lba;



	if (lba_count == 0) {

	if (lba_count == 0 || lba_count > UINT16_MAX + 1) {

		return -EINVAL;

	}