iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scsi: megaraid_sas: Check user-provided offsets

Browse Source 
commit 381d34e376 upstream.

It sounds unwise to let user space pass an unchecked 32-bit offset into a
kernel structure in an ioctl. This is an unsigned variable, so checking the
upper bound for the size of the structure it points into is sufficient to
avoid data corruption, but as the pointer might also be unaligned, it has
to be written carefully as well.

While I stumbled over this problem by reading the code, I did not continue
checking the function for further problems like it.

Link: https://lore.kernel.org/r/20201030164450.1253641-2-arnd@kernel.org
Fixes: c4a3e0a529 ("[SCSI] MegaRAID SAS RAID: new driver")
Cc: <stable@vger.kernel.org> # v2.6.15+
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Arnd Bergmann
2020-10-30 17:44:20 +01:00
committed by Greg Kroah-Hartman
parent 7812d88349
commit 79ab763e57
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/scsi/megaraid/megaraid_sas_base.c
View File

@ -8095,7 +8095,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
int error = 0, i; int error = 0, i;
void *sense = NULL; void *sense = NULL;
dma_addr_t sense_handle; dma_addr_t sense_handle;
unsigned long *sense_ptr; void *sense_ptr;
u32 opcode = 0; u32 opcode = 0;
int ret = DCMD_SUCCESS; int ret = DCMD_SUCCESS;
@ -8218,6 +8218,13 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
} }
if (ioc->sense_len) { if (ioc->sense_len) {
/* make sure the pointer is part of the frame */
if (ioc->sense_off >
(sizeof(union megasas_frame) - sizeof(__le64))) {
error = -EINVAL;
goto out;
}
sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len, sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len,
&sense_handle, GFP_KERNEL); &sense_handle, GFP_KERNEL);
if (!sense) { if (!sense) {
@ -8225,12 +8232,11 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
goto out; goto out;
} }
sense_ptr = sense_ptr = (void *)cmd->frame + ioc->sense_off;
(unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
if (instance->consistent_mask_64bit) if (instance->consistent_mask_64bit)
*sense_ptr = cpu_to_le64(sense_handle); put_unaligned_le64(sense_handle, sense_ptr);
else else
*sense_ptr = cpu_to_le32(sense_handle); put_unaligned_le32(sense_handle, sense_ptr);
} }
/* /*