mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 14:44:12 +00:00
Code Issues Releases Wiki Activity

scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses

Browse source 
Sanitize possible addl_desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().

Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Tomas Henzl 2023-02-02 17:24:49 +01:00 committed by Martin K. Petersen
parent 9b4f5028e4
commit db95d4df71
1 changed files with 26 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
drivers/scsi/ses.c
View file

@ -439,8 +439,8 @@ int ses_match_host(struct enclosure_device *edev, void *data)
}
#endif /* 0 */
static void ses_process_descriptor(struct enclosure_component *ecomp,
unsigned char *desc)
static int ses_process_descriptor(struct enclosure_component *ecomp,
unsigned char *desc, int max_desc_len)
{
int eip = desc[0] & 0x10;
int invalid = desc[0] & 0x80;
@ -451,22 +451,32 @@ static void ses_process_descriptor(struct enclosure_component *ecomp,
unsigned char *d;
if (invalid)
return;
return 0;
switch (proto) {
case SCSI_PROTOCOL_FCP:
if (eip) {
if (max_desc_len <= 7)
return 1;
d = desc + 4;
slot = d[3];
}
break;
case SCSI_PROTOCOL_SAS:
if (eip) {
if (max_desc_len <= 27)
return 1;
d = desc + 4;
slot = d[3];
d = desc + 8;
} else
} else {
if (max_desc_len <= 23)
return 1;
d = desc + 4;
}
/* only take the phy0 addr */
addr = (u64)d[12] << 56 |
(u64)d[13] << 48 |
@ -483,6 +493,8 @@ static void ses_process_descriptor(struct enclosure_component *ecomp,
}
ecomp->slot = slot;
scomp->addr = addr;
return 0;
}
struct efd {
@ -555,7 +567,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
/* skip past overall descriptor */
desc_ptr += len + 4;
}
if (ses_dev->page10)
if (ses_dev->page10 && ses_dev->page10_len > 9)
addl_desc_ptr = ses_dev->page10 + 8;
type_ptr = ses_dev->page1_types;
components = 0;
@ -563,6 +575,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
for (j = 0; j < type_ptr[1]; j++) {
char *name = NULL;
struct enclosure_component *ecomp;
int max_desc_len;
if (desc_ptr) {
if (desc_ptr >= buf + page7_len) {
@ -589,10 +602,14 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
ecomp = &edev->component[components++];
if (!IS_ERR(ecomp)) {
if (addl_desc_ptr)
ses_process_descriptor(
ecomp,
addl_desc_ptr);
if (addl_desc_ptr) {
max_desc_len = ses_dev->page10_len -
(addl_desc_ptr - ses_dev->page10);
if (ses_process_descriptor(ecomp,
addl_desc_ptr,
max_desc_len))
addl_desc_ptr = NULL;
}
if (create)
enclosure_component_register(
ecomp);