diff --git a/0029-NVMF-lib-nvmf-limit-number-of-NVMe-oF-registrants-when-up.patch b/0029-NVMF-lib-nvmf-limit-number-of-NVMe-oF-registrants-when-up.patch new file mode 100644 index 0000000000000000000000000000000000000000..39c45f79f15fa76133a5708f30b7733fb4054526 --- /dev/null +++ b/0029-NVMF-lib-nvmf-limit-number-of-NVMe-oF-registrants-when-up.patch @@ -0,0 +1,93 @@ +From cfac20da65da7391a79125e444d30dae3909654c Mon Sep 17 00:00:00 2001 +From: Tomasz Zawadzki +Date: Thu, 6 Nov 2025 03:49:34 +0800 +Subject: [PATCH] [Backport]NVMF: lib nvmf limit number of NVMe-oF registrants when up + PTPL info + +Limit the number of NVMe-oF registrants that are kept when using PTPL (Persist through power loss). + +Change-Id: I5207652b4a6e7313b3b4dbee212aa2be692d8b59 +Signed-off-by: Joel Cunningham +Reported-by: Joel Cunningham +Signed-off-by: Tomasz Zawadzki +Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/26777 +Tested-by: SPDK Automated Test System +Reviewed-by: Konrad Sztyber +Reviewed-by: Jacek Kalwas +Adapted-by: Jing SiXiang + +Reference:https://gitee.com/src-openeuler/spdk/commit/1deb6ee549ad8193718a2fe17891fa6bb8a5a79d +Conflict:no +--- + lib/nvmf/subsystem.c | 11 +++++--- + test/unit/lib/nvmf/subsystem.c/subsystem_ut.c | 26 +++++++++++++++++++ + 2 files changed, 34 insertions(+), 3 deletions(-) + +diff --git a/lib/nvmf/subsystem.c b/lib/nvmf/subsystem.c +index 5729524..9f94e0d 100644 +--- a/lib/nvmf/subsystem.c ++++ b/lib/nvmf/subsystem.c +@@ -1994,9 +1994,14 @@ nvmf_ns_update_reservation_info(struct spdk_nvmf_ns *ns) + } + + TAILQ_FOREACH_SAFE(reg, &ns->registrants, link, tmp) { +- spdk_uuid_fmt_lower(info.registrants[i].host_uuid, sizeof(info.registrants[i].host_uuid), +- ®->hostid); +- info.registrants[i++].rkey = reg->rkey; ++ if (i < SPDK_NVMF_MAX_NUM_REGISTRANTS) { ++ spdk_uuid_fmt_lower(info.registrants[i].host_uuid, sizeof(info.registrants[i].host_uuid), ++ ®->hostid); ++ info.registrants[i++].rkey = reg->rkey; ++ } else { ++ SPDK_ERRLOG("More registrants that can fit into reservation info, truncating\n"); ++ break; ++ } + } + + info.num_regs = i; +diff --git a/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c b/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c +index df57241..c51a80b 100644 +--- a/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c ++++ b/test/unit/lib/nvmf/subsystem.c/subsystem_ut.c +@@ -1362,6 +1362,31 @@ test_spdk_nvmf_ns_event(void) + free(tgt.subsystems); + } + ++static void ++test_nvmf_ns_reservation_add_max_registrants(void) ++{ ++ ut_reservation_init(); ++ ++ struct spdk_nvmf_reservation_info info = {}; ++ int rc; ++ ++ /* Register 1 past the max */ ++ uint32_t i = 0; ++ for (i = 0; i < SPDK_NVMF_MAX_NUM_REGISTRANTS + 1; i++) { ++ spdk_uuid_generate(&g_ctrlr1_A.hostid); ++ rc = nvmf_ns_reservation_add_registrant(&g_ns, &g_ctrlr1_A, 0xa11 + i); ++ CU_ASSERT(rc == 0); ++ } ++ /* Update the reservation info */ ++ rc = nvmf_ns_update_reservation_info(&g_ns); ++ CU_ASSERT(rc == 0); ++ /* Validate that info is capped at max */ ++ CU_ASSERT_EQUAL(info.num_regs, SPDK_NVMF_MAX_NUM_REGISTRANTS); ++ /* Clear should return max + 1 */ ++ uint32_t cleared = nvmf_ns_reservation_clear_all_registrants(&g_ns); ++ CU_ASSERT_EQUAL(cleared, SPDK_NVMF_MAX_NUM_REGISTRANTS + 1); ++} ++ + + int main(int argc, char **argv) + { +@@ -1387,6 +1412,7 @@ int main(int argc, char **argv) + CU_ADD_TEST(suite, test_reservation_clear_notification); + CU_ADD_TEST(suite, test_reservation_preempt_notification); + CU_ADD_TEST(suite, test_spdk_nvmf_ns_event); ++ CU_ADD_TEST(suite, test_nvmf_ns_reservation_add_max_registrants); + + allocate_threads(1); + set_thread(0); +-- +2.43.0 \ No newline at end of file diff --git a/spdk.spec b/spdk.spec index 282173098964ca97515f7d8a8231eeeb51d338de..9506bbafb476721dece5102db8e9c2200092d9cf 100644 --- a/spdk.spec +++ b/spdk.spec @@ -3,7 +3,7 @@ Name: spdk Version: 21.01.1 -Release: 15 +Release: 16 Summary: Set of libraries and utilities for high performance user-mode storage License: BSD and MIT URL: http://spdk.io @@ -36,6 +36,7 @@ Patch25: 0025-ut-rdma-Fix-GCC-10.2.0-warning.patch Patch26: 0026-lib-nvme-add-mutex-before-submit-admin-request.patch Patch27: 0027--nvme-cuse-Add-ctrlr_lock-for-cuse-register-and-unreg.patch Patch28: 0028-fixed-use-after-free-detected-by-Coverity.patch +Patch29: 0029-NVMF-lib-nvmf-limit-number-of-NVMe-oF-registrants-when-up.patch %define package_version %{version}-%{release} @@ -206,6 +207,9 @@ mv doc/output/html/ %{install_docdir} %changelog +* Wed Nov 5 2025 zhangjian - 21.01.1-16 +- fix cve-2025-57275 + * Mon May 20 2024 yanshuai - 21.01.1-15 - lib/nvme: fixed use-after-free detected by Coverity