The number of ANA groups advertised through Identify Controller sizes the
ANA log buffer. The ANA log header and group descriptors independently
supply the number of groups and namespace IDs to parse.

Both bounds checks subtract an untrusted object size from ana_log_size
before comparing the current offset. If the object is larger than the
buffer, the size_t subtraction underflows and lets the parser read beyond
ana_log_buf.

Check the current offset before the first subtraction and compare each
object size with the remaining buffer instead. This rejects inconsistent
ANA data before dereferencing a truncated group descriptor or walking an
oversized namespace ID array.

Fixes: 0d0b660f214d ("nvme: add ANA support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
Affected versions: v4.19-rc1 through current mainline 587858367581.

Triggering conditions:
- CONFIG_NVME_MULTIPATH=y and the controller advertises ANA support.
- Identify Controller sizes a 52-byte ANA log with MNAN=1 and
  NANAGRPID=1.
- The returned ANA log has NGRPS=1 and NNSIDS=16.

An nvme-loop target returning the values above reproduced the host-side
KASAN read on 3/3 fresh v7.2 boots.  The first report was:

  BUG: KASAN: slab-out-of-bounds in nvme_update_ana_state+0x2eb/0x360
  Read of size 4
  Workqueue: nvme-wq nvme_ana_work
  nvme_update_ana_state
  nvme_parse_ana_log
  nvme_read_ana_log
  nvme_ana_work

KASAN identified the access as zero bytes beyond the allocated 52-byte
region and traced the allocation to nvme_mpath_init_identify().  With this
fix, the same target response produced no KASAN report on 3/3 fresh boots
and was rejected with -EINVAL at the corrected check.  The changed object
also builds warning-free with W=1 and an x86_64 allmodconfig.  Reproducer
source is available privately on request and is intentionally not included
in this public mail.

 drivers/nvme/host/multipath.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 75dbb58286a3..29d447a5d0de 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -845,7 +845,8 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data,
 		u32 nr_nsids;
 		size_t nsid_buf_size;
 
-		if (WARN_ON_ONCE(offset > ctrl->ana_log_size - sizeof(*desc)))
+		if (WARN_ON_ONCE(offset > ctrl->ana_log_size ||
+				 sizeof(*desc) > ctrl->ana_log_size - offset))
 			return -EINVAL;
 
 		nr_nsids = le32_to_cpu(desc->nnsids);
@@ -861,7 +862,7 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data,
 			return -EINVAL;
 
 		offset += sizeof(*desc);
-		if (WARN_ON_ONCE(offset > ctrl->ana_log_size - nsid_buf_size))
+		if (WARN_ON_ONCE(nsid_buf_size > ctrl->ana_log_size - offset))
 			return -EINVAL;
 
 		error = cb(ctrl, desc, data);

base-commit: 587858367581b9c55c3690f4e63382ad622719d4

On Tue, Sep 15, 2026 at 11:19:56AM +0900, Daehyeon Ko wrote:
> The number of ANA groups advertised through Identify Controller sizes the
> ANA log buffer. The ANA log header and group descriptors independently
> supply the number of groups and namespace IDs to parse.
> 
> Both bounds checks subtract an untrusted object size from ana_log_size
> before comparing the current offset. If the object is larger than the
> buffer, the size_t subtraction underflows and lets the parser read beyond
> ana_log_buf.
> 
> Check the current offset before the first subtraction and compare each
> object size with the remaining buffer instead. This rejects inconsistent
> ANA data before dereferencing a truncated group descriptor or walking an
> oversized namespace ID array.

Thanks, applied to nvme-7.3.

On Tue, Sep 15, 2026 at 11:19:56AM +0900, Daehyeon Ko wrote:
> The number of ANA groups advertised through Identify Controller sizes the
> ANA log buffer. The ANA log header and group descriptors independently
> supply the number of groups and namespace IDs to parse.
> 
> Both bounds checks subtract an untrusted object size from ana_log_size
> before comparing the current offset. If the object is larger than the
> buffer, the size_t subtraction underflows and lets the parser read beyond
> ana_log_buf.
> 
> Check the current offset before the first subtraction and compare each
> object size with the remaining buffer instead. This rejects inconsistent
> ANA data before dereferencing a truncated group descriptor or walking an
> oversized namespace ID array.

Thanks, applied to nvme-7.3.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>