Re: [PATCH] nvmet: check sscanf value for subsys serial attr

[Christoph Hellwig <hch@infradead.org>]

On Thu, Nov 21, 2019 at 12:31:42PM -0800, Chaitanya Kulkarni wrote:
> For nvmet in configfs.c we check return values for all the sscanf()
> calls. Add similar check into the nvmet_subsys_attr_serial_store().
> 
> Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
> ---
>  drivers/nvme/target/configfs.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
> index 98613a45bd3b..cc1fd36bf71e 100644
> --- a/drivers/nvme/target/configfs.c
> +++ b/drivers/nvme/target/configfs.c
> @@ -853,12 +853,14 @@ static ssize_t nvmet_subsys_attr_serial_store(struct config_item *item,
>  					      const char *page, size_t count)
>  {
>  	struct nvmet_subsys *subsys = to_subsys(item);
> +	int ret = 0;
>  
>  	down_write(&nvmet_config_sem);
> -	sscanf(page, "%llx\n", &subsys->serial);
> +	if (sscanf(page, "%llx\n", &subsys->serial) != 1)
> +		ret = -EINVAL;
>  	up_write(&nvmet_config_sem);
>  
> -	return count;
> +	return ret ? ret : count;

So the problem is that we've already possible corrupted subsys->serial
when an error occurs.  So I think we need a local variable to sscan
in, return an error if that fails and only if it succeeds take the lock
and assign it to subsys->serial.

_______________________________________________
linux-nvme mailing list
linux-nvme@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme