mbox series

[0/3] Log correct rpmb unit descriptor size

Message ID 20210727123546.17228-1-avri.altman@wdc.com
Headers show
Series Log correct rpmb unit descriptor size | expand

Message

Avri Altman July 27, 2021, 12:35 p.m. UTC 
For the rpmb unit descriptor, if the field offset is larger than 0x23,
it may trigger a stack corruption because a) we do not log properly the
rpmb unit descriptor size,  and b) ufs_is_valid_unit_desc_lun() test for
specific wb offset case, and does not verify that the requested field
does not exceed the descriptor size.

Fix both issues.

Reported-by: Bart Van Assche <bvanassche@google.com>

Avri Altman (3):
  scsi: ufs: Remove redundant define
  scsi: ufs: Map the correct size to the rpmb unit descriptor
  scsi: ufs: Generalize ufs_is_valid_unit_desc_lun()

 drivers/scsi/ufs/ufs-sysfs.c |  2 +-
 drivers/scsi/ufs/ufs.h       | 21 +--------------------
 drivers/scsi/ufs/ufs_bsg.c   |  3 ++-
 drivers/scsi/ufs/ufshcd.c    | 19 ++++++++++++-------
 drivers/scsi/ufs/ufshcd.h    | 27 ++++++++++++++++++++++++++-
 5 files changed, 42 insertions(+), 30 deletions(-)

Comments

Martin K. Petersen Aug. 6, 2021, 3:03 a.m. UTC | #1 
Avri,

> For the rpmb unit descriptor, if the field offset is larger than 0x23,

> it may trigger a stack corruption because a) we do not log properly the

> rpmb unit descriptor size,  and b) ufs_is_valid_unit_desc_lun() test for

> specific wb offset case, and does not verify that the requested field

> does not exceed the descriptor size.


Please rebase on top of 5.15/scsi-staging and fix the resulting
errors. Thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering