linux/drivers/block
Christoph Hellwig 3fd61b2099 nvme: fix kernel memory corruption with short INQUIRY buffers
If userspace asks for an INQUIRY buffer smaller than 36 bytes, the SCSI
translation layer will happily write past the end of the INQUIRY buffer
allocation.

This is fairly easily reproducible by running the libiscsi test
suite and then starting an xfstests run.

Fixes: 4f1982 ("NVMe: Update SCSI Inquiry VPD 83h translation")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
2015-05-13 10:22:12 -04:00
..
aoe
drbd Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
mtip32xx
paride paride: fix the "verbose" module param 2015-04-15 16:35:22 -07:00
rsxx
xen-blkback xen/grant: introduce func gnttab_unmap_refs_sync() 2015-04-27 11:41:12 +01:00
zram revert "zram: move compact_store() to sysfs functions area" 2015-05-05 17:10:10 -07:00
amiflop.c
ataflop.c
brd.c
cciss_cmd.h
cciss_scsi.c
cciss_scsi.h
cciss.c
cciss.h
cpqarray.c
cpqarray.h
cryptoloop.c
DAC960.c
DAC960.h
floppy.c
hd.c
ida_cmd.h
ida_ioctl.h
Kconfig
loop.c block: destroy bdi before blockdev is unregistered. 2015-04-27 10:27:20 -06:00
loop.h
Makefile
mg_disk.c
nbd.c
null_blk.c
nvme-core.c Merge branch 'for-4.1/drivers' of git://git.kernel.dk/linux-block 2015-04-16 22:05:27 -04:00
nvme-scsi.c nvme: fix kernel memory corruption with short INQUIRY buffers 2015-05-13 10:22:12 -04:00
osdblk.c
pktcdvd.c
pmem.c
ps3disk.c
ps3vram.c
rbd_types.h
rbd.c rbd: end I/O the entire obj_request on error 2015-05-01 16:44:30 -07:00
skd_main.c
skd_s1120.h
smart1,2.h
sunvdc.c
swim3.c
swim_asm.S
swim.c
sx8.c
umem.c
umem.h
virtio_blk.c
xen-blkfront.c
xsysace.c
z2ram.c