Skip to content

plugins/micron: clamp num_entries in vs-fw-activate-history to the table size - #4025

Merged
igaw merged 1 commit into
linux-nvme:masterfrom
prabhakarpujeri:micron-fw-hist-clamp
Sep 15, 2026
Merged

igaw merged 1 commit into
linux-nvme:masterfrom
prabhakarpujeri:micron-fw-hist-clamp

Conversation

@prabhakarpujeri

Copy link
Copy Markdown

Summary

num_entries in the micron fw activation history log page is device-supplied.
Both printers used it as the loop bound (without even le32_to_cpu()) against
the fixed entries[20] table in struct micron_fw_activation_history_table,
which lives inside the 4096-byte log page:

for (count = 0; count < table->num_entries; count++) {
    if (!display_fw_activate_entry(count, &table->entries[count],
            formatted_output, sizeof(formatted_output), NULL))
        printf("%s
", formatted_output);
}

A device reporting a count above 20 runs both loops past the array, emitting
bytes past the log buffer into stdout or into the JSON envelope.

This is the exact same pattern as #3993 (seagate fw-activate-history entry-count
clamp) that igaw merged on 2026-09-08.

Fix

Clamp table->num_entries to ARRAY_SIZE(table->entries) right after the
existing version/log-page validation, so both views see the bounded value. The
clamp also applies le32_to_cpu/cpu_to_le32 at that point.

Testing

  • meson setup build-main && ninja -C build-main: clean.
  • Hostile-input harness (ASan+UBSan) with num_entries = 0xFFFFFFFF:
    • pre-fix: heap-buffer-overflow — read of size 1 at 52 bytes past a
      4116-byte allocation;
    • post-fix: loop runs exactly 20 iterations, exit 0.

num_entries in the fw activation history log page is device-supplied.
Both printers used it as the loop bound (without even le32_to_cpu)
against the fixed 20-entry table inside the 4096-byte page: a device
reporting a count above 20 runs the loops past the array, printing or
JSON-emitting bytes past the log buffer.

Clamp the count to the array size right after the version/log-page
check so both the plain and the JSON view see a bounded value, and
apply little-endian conversion at the clamp point.

Hostile-input ASan/UBSan harness: pre-fix loop reads past the
4096-byte allocation; post-fix walk completes and exits 0.

Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
@igaw
igaw merged commit 8cda7cd into linux-nvme:master Sep 15, 2026
32 checks passed
@igaw

igaw commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants