From 22e81f3e3929d8ebec716c4463c247efec30a1bf Mon Sep 17 00:00:00 2001 From: lizhipeng Date: Fri, 10 Oct 2025 19:34:44 +0800 Subject: [PATCH] fix CVE-2025-57275 Signed-off-by: lizhipeng --- backport-fix-CVE-2025-57275.patch | 98 +++++++++++++++++++++++++++++++ spdk.spec | 6 +- 2 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 backport-fix-CVE-2025-57275.patch diff --git a/backport-fix-CVE-2025-57275.patch b/backport-fix-CVE-2025-57275.patch new file mode 100644 index 0000000..d63f00c --- /dev/null +++ b/backport-fix-CVE-2025-57275.patch @@ -0,0 +1,98 @@ +From 8981ddb1ccaf54f85d34482a5a644e075b58cb36 Mon Sep 17 00:00:00 2001 +From: Tomasz Zawadzki +Date: Thu, 25 Sep 2025 18:51:37 +0200 +Subject: [PATCH] lib/nvmf: limit number of NVMe-oF registrants when updating + PTPL info + +Limit the number of NVMe-oF registrants that are kept when using PTPL (Persist through power loss). + +Change-Id: I5207652b4a6e7313b3b4dbee212aa2be692d8b59 +Signed-off-by: Joel Cunningham +Reported-by: Joel Cunningham +Signed-off-by: Tomasz Zawadzki +Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/26777 +Tested-by: SPDK Automated Test System +Reviewed-by: Konrad Sztyber +Reviewed-by: Jacek Kalwas +--- + lib/nvmf/subsystem.c | 11 ++++-- + test/unit/lib/nvmf/subsystem.c/subsystem_ut.c | 34 +++++++++++++++++++ + 2 files changed, 42 insertions(+), 3 deletions(-) + +diff --git a/lib/nvmf/subsystem.c b/lib/nvmf/subsystem.c +index a9bc42698..54de73d4f 100644 +--- a/lib/nvmf/subsystem.c ++++ b/lib/nvmf/subsystem.c +@@ -2936,9 +2936,14 @@ nvmf_ns_update_reservation_info(struct spdk_nvmf_ns *ns) + } + + TAILQ_FOREACH_SAFE(reg, &ns->registrants, link, tmp) { +- spdk_uuid_fmt_lower(info.registrants[i].host_uuid, sizeof(info.registrants[i].host_uuid), +- ®->hostid); +- info.registrants[i++].rkey = reg->rkey; ++ if (i < SPDK_NVMF_MAX_NUM_REGISTRANTS) { ++ spdk_uuid_fmt_lower(info.registrants[i].host_uuid, sizeof(info.registrants[i].host_uuid), ++ ®->hostid); ++ info.registrants[i++].rkey = reg->rkey; ++ } else { ++ SPDK_ERRLOG("More registrants that can fit into reservation info, truncating\n"); ++ break; ++ } + } + + info.num_regs = i; +diff --git a/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c b/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c +index b319eaca8..23d63d784 100644 +--- a/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c ++++ b/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c +@@ -2702,6 +2702,39 @@ test_nvmf_reservation_custom_ops(void) + ut_reservation_deinit(); + } + ++static void ++test_nvmf_ns_reservation_add_max_registrants(void) ++{ ++ struct spdk_nvmf_ns_reservation_ops ops = { ++ .is_ptpl_capable = ut_is_ptpl_capable, ++ .update = ut_update_reservation, ++ .load = ut_load_reservation, ++ }; ++ spdk_nvmf_set_custom_ns_reservation_ops(&ops); ++ ut_reservation_init(); ++ ++ struct spdk_nvmf_reservation_info info = {}; ++ int rc; ++ ++ /* Register 1 past the max */ ++ uint32_t i = 0; ++ for (i = 0; i < SPDK_NVMF_MAX_NUM_REGISTRANTS + 1; i++) { ++ spdk_uuid_generate(&g_ctrlr1_A.hostid); ++ rc = nvmf_ns_reservation_add_registrant(&g_ns, &g_ctrlr1_A, 0xa11 + i); ++ CU_ASSERT(rc == 0); ++ } ++ /* Update the reservation info */ ++ rc = nvmf_ns_update_reservation_info(&g_ns); ++ CU_ASSERT(rc == 0); ++ /* Validate that info is capped at max */ ++ rc = nvmf_ns_reservation_load(&g_ns, &info); ++ CU_ASSERT(rc == 0); ++ CU_ASSERT_EQUAL(info.num_regs, SPDK_NVMF_MAX_NUM_REGISTRANTS); ++ /* Clear should return max + 1 */ ++ uint32_t cleared = nvmf_ns_reservation_clear_all_registrants(&g_ns); ++ CU_ASSERT_EQUAL(cleared, SPDK_NVMF_MAX_NUM_REGISTRANTS + 1); ++} ++ + int + main(int argc, char **argv) + { +@@ -2740,6 +2773,7 @@ main(int argc, char **argv) + CU_ADD_TEST(suite, test_nvmf_ns_reservation_restore); + CU_ADD_TEST(suite, test_nvmf_subsystem_state_change); + CU_ADD_TEST(suite, test_nvmf_reservation_custom_ops); ++ CU_ADD_TEST(suite, test_nvmf_ns_reservation_add_max_registrants); + + allocate_threads(1); + set_thread(0); +-- +2.47.2 + diff --git a/spdk.spec b/spdk.spec index d2d84f6..af7cdcf 100644 --- a/spdk.spec +++ b/spdk.spec @@ -4,7 +4,7 @@ Name: spdk Version: 24.01 -Release: 10 +Release: 11 Summary: Set of libraries and utilities for high performance user-mode storage License: BSD and MIT URL: http://spdk.io @@ -13,6 +13,7 @@ Patch1: 0001-Add-without-ISA-L-option-and-disabled-by-default.patch Patch2: 0002-backport-Add-ctrlr_lock-for-cuse-register-and-unregister.patch Patch3: 0100-spdk-uos-add-sw64-support.patch Patch4: 0004-vhost-add-vhost-interrupt-coalescing.patch +Patch5: backport-fix-CVE-2025-57275.patch %define package_version %{version}-%{release} @@ -184,6 +185,9 @@ mv doc/output/html/ %{install_docdir} %changelog +* Fri Oct 10 2025 lizhipeng - 24.01-11 +- Fix CVE-2025-57275 + * Wed Aug 20 2025 zhangjian - 24.01-10 - add setup.sh to rpm packages -- Gitee