From patchwork Wed Dec 23 15:33:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 351456 Delivered-To: patch@linaro.org Received: by 2002:a02:85a7:0:0:0:0:0 with SMTP id d36csp6295440jai; Wed, 23 Dec 2020 07:37:22 -0800 (PST) X-Google-Smtp-Source: ABdhPJw9fCSKDt75ZAhccgSBQG9inpVqoQz5nD2WmH/rilg265C74POiTm2mmJHMvzJ7s9jTXsuk X-Received: by 2002:a17:906:1194:: with SMTP id n20mr24226017eja.269.1608737842383; Wed, 23 Dec 2020 07:37:22 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1608737842; cv=none; d=google.com; s=arc-20160816; b=rANa9ap2Y6dkOAH/pVt9TXKJzIO82QZPAI/qwG8Isbq8qCXgQKXqPbGzi9KsF8srky xjbglFAqHYEAF2bu3/7rbg0HJ466xDCP6Ogm6YVNufYVFcScTSmGbYk6jhXkiFIiRXXG W/4mePBSJPnsywg6vQ+7I5URSvBQgaainLH/67gQ3exskwyaS2mbd9lwj3Ipx97VQZAs x1BTPCbSBP4ZVHYkeQl+YPXKo3y9L+a3sUgSdPf2pGaLVfrl0wykOa2sqvX3yvoeBTzh Gh55cYv2pCG5LDHPBrIl67mk/rB+0ZGFrxrjb32eCwjosFRq0mpR8coV3Vf4sEkhzH/x q/XA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=5IYh1VS+o0ywQEu+NlvijHn9Xde1liPvYM4FwCpHQO8=; b=nF/aLhwwNUSK71dFvHDr1gqizSq0Mve6jqmywz7cUWkuExIZfCgBLdYxh6YeZTIbut JGXOhk1Yp9IZMp7cQWuXDZSz/ois+LYPROZ/TZhUfAhdd9F4y0jGrIS0mgHQOd4wuGpo ncO4Mt/4MqwIEH/NqWc5ocffMOSLtDoN3MdGKwuu6FM5rLZUdOxwhsaSttHYjAURcqWA EG99ZQc51mzYUmyRGlj8BOay/ICrYfmn5Utyv/ty9Vw4R0Cwfl/RLbvKouqXC1Bh0chk VRvAKBsaRzO8+0anOCOWuLz3mTIrIbPQCxC8lt+Fot0+tEqW7bsox1y6msPfwkoNRVhJ eWhg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=kFW920zo; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l14si14537114eds.359.2020.12.23.07.37.22; Wed, 23 Dec 2020 07:37:22 -0800 (PST) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=kFW920zo; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727533AbgLWPgP (ORCPT + 14 others); Wed, 23 Dec 2020 10:36:15 -0500 Received: from mail.kernel.org ([198.145.29.99]:44716 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728588AbgLWPeR (ORCPT ); Wed, 23 Dec 2020 10:34:17 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 6DF9323341; Wed, 23 Dec 2020 15:33:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1608737604; bh=Cb1poMD1q3CgMuXZGqUp5gghjPRMlv/8zQDMUTdURV0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kFW920zoDrsWOpu/4Tmg8VjkOYHFnSuOTxt0lF0Fh89hakX9dTU33FdGiQtD2KcI7 XVDFXdVeiHSlHvILv+wWMtLb+Y4xFPtV3FJfD/sj7AQ9eUhdFZDkJfsO1wgfgsk3rT rRplSPLZkNdXjwyBVgv5TV78HZ6g9cvy+ger948c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , Arnd Bergmann , "Martin K. Petersen" Subject: [PATCH 5.10 26/40] scsi: megaraid_sas: Check user-provided offsets Date: Wed, 23 Dec 2020 16:33:27 +0100 Message-Id: <20201223150516.813786166@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201223150515.553836647@linuxfoundation.org> References: <20201223150515.553836647@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann commit 381d34e376e3d9d27730fda8a0e870600e6c8196 upstream. It sounds unwise to let user space pass an unchecked 32-bit offset into a kernel structure in an ioctl. This is an unsigned variable, so checking the upper bound for the size of the structure it points into is sufficient to avoid data corruption, but as the pointer might also be unaligned, it has to be written carefully as well. While I stumbled over this problem by reading the code, I did not continue checking the function for further problems like it. Link: https://lore.kernel.org/r/20201030164450.1253641-2-arnd@kernel.org Fixes: c4a3e0a529ab ("[SCSI] MegaRAID SAS RAID: new driver") Cc: # v2.6.15+ Reviewed-by: Christoph Hellwig Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/megaraid/megaraid_sas_base.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -8095,7 +8095,7 @@ megasas_mgmt_fw_ioctl(struct megasas_ins int error = 0, i; void *sense = NULL; dma_addr_t sense_handle; - unsigned long *sense_ptr; + void *sense_ptr; u32 opcode = 0; int ret = DCMD_SUCCESS; @@ -8218,6 +8218,13 @@ megasas_mgmt_fw_ioctl(struct megasas_ins } if (ioc->sense_len) { + /* make sure the pointer is part of the frame */ + if (ioc->sense_off > + (sizeof(union megasas_frame) - sizeof(__le64))) { + error = -EINVAL; + goto out; + } + sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len, &sense_handle, GFP_KERNEL); if (!sense) { @@ -8225,12 +8232,11 @@ megasas_mgmt_fw_ioctl(struct megasas_ins goto out; } - sense_ptr = - (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off); + sense_ptr = (void *)cmd->frame + ioc->sense_off; if (instance->consistent_mask_64bit) - *sense_ptr = cpu_to_le64(sense_handle); + put_unaligned_le64(sense_handle, sense_ptr); else - *sense_ptr = cpu_to_le32(sense_handle); + put_unaligned_le32(sense_handle, sense_ptr); } /*