Commit bae7cfb4 authored by John Levon's avatar John Levon Committed by Jim Harris
Browse files

lib/nvmf: sanity check connect buffer 



nvmf_ctrlr_cmd_connect() can only handle a request in one buffer
(req->data); sanity check it's not split across IOVs.

Signed-off-by: default avatarJohn Levon <john.levon@nutanix.com>
Change-Id: I595d8542ce71e56cf2b074f4cf41bce440f6dc26
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/16123


Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
Reviewed-by: default avatarThanos Makatos <thanos.makatos@nutanix.com>
Reviewed-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
parent ad521730

lib/nvmf/ctrlr.c

+6 −0
Original line number Diff line number Diff line
@@ -919,6 +919,12 @@ nvmf_ctrlr_cmd_connect(struct spdk_nvmf_request *req) 
		return SPDK_NVMF_REQUEST_EXEC_STATUS_COMPLETE;

	}



	if (req->iovcnt > 1) {

		SPDK_ERRLOG("Connect command invalid iovcnt: %d\n", req->iovcnt);

		rsp->status.sc = SPDK_NVME_SC_INVALID_FIELD;

		return SPDK_NVMF_REQUEST_EXEC_STATUS_COMPLETE;

	}



	subsystem = spdk_nvmf_tgt_find_subsystem(transport->tgt, data->subnqn);

	if (!subsystem) {

		SPDK_NVMF_INVALID_CONNECT_DATA(rsp, subnqn);