From patchwork Mon Dec 28 12:46:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 352646 Delivered-To: patch@linaro.org Received: by 2002:a02:85a7:0:0:0:0:0 with SMTP id d36csp9750364jai; Mon, 28 Dec 2020 05:34:16 -0800 (PST) X-Google-Smtp-Source: ABdhPJybnG8Qks+AzPS0BIi3x/61Y/2dGI+VQRYTxxgdK7azbiAm8jNIGlQiZnuZ42/D2tlJT1Ky X-Received: by 2002:a17:907:20b5:: with SMTP id pw21mr43222676ejb.494.1609162048119; Mon, 28 Dec 2020 05:27:28 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1609162048; cv=none; d=google.com; s=arc-20160816; b=GGPLHnU7JHtganOqYLHTncHIFBT0NH5j2bjR3wDeDHxH199YmFLDXVIk1TJ/jKgnS0 akL/mGjfVBYEnCH0a4xDXEvC61Sb2UJtb7PbUUTg+POQkcercCc/lF6ZOApT5g0uQGRY M1nmh24hodNcmOy+kA/i1qRDz7bwq+ErePBzWOSSFrzlChEmOaWpS3oQ1WMy3OZo+u0p lI3/AfOzmiCdI/0QWNxS8pkxSlkbED6sbU8gP2xHVM1D+K7nRMAcHje8NtrU5YTv+Cg4 SMcSn7FIQjQQlQ7YSxBvX9taWLws1XIN5rMgbZNHFBzTSlpOi9v2hziZZ+C241+x1M/B d9Rw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=9hRVplIQWm/lUQ7VZQPn0Cm4gNOSe/FOdPAaHTMvF6s=; b=qqtQC76yIIbzMCBnskz0ik4/HK0EMMVJalysmiztyjnq22KH5xWrE6T8geHq0EVhio 5QbgKe1PQiw5si0G/VicQEeLn5nlwTv+VghHoMRpjCwuaCHyJHz4Ywj22Fy6SQapd0Ki N8cN99bVPopRTXNioKSowlpecPaVPF7FF6aeEEuDfgXCdl5qZ+srlUe3p4at5jpwLbtz eTWuF9l+fMIm7u4JqNZe26LNNTYfDa5nFIm151ph3dDRaCtF162HIMPu9+LMCOXmGcI6 8QRtv5I5ktDMWCUsWuX6N/j4Ip+Y1VeWrXZ7psozDsLJ1cijEIyENZRER4mAdbZWsZEn E0BQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=E1J6TdSD; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ho39si19307546ejc.745.2020.12.28.05.27.27; Mon, 28 Dec 2020 05:27:28 -0800 (PST) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=E1J6TdSD; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388906AbgL1NZ2 (ORCPT + 14 others); Mon, 28 Dec 2020 08:25:28 -0500 Received: from mail.kernel.org ([198.145.29.99]:54044 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388902AbgL1NZ0 (ORCPT ); Mon, 28 Dec 2020 08:25:26 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id CF9F220719; Mon, 28 Dec 2020 13:24:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1609161885; bh=6JE0UNhSRbQ5lIXyrZXz7GwSnXiv+R1sJx4VaR0Fduk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E1J6TdSD0SA1HLcmzkxoCyqr3g80TuNdXT2kt6cz6g1SS+YiNfL5XuVIhaDal683q /8n+8tA3w86PXC3nNKXQspiBRVKXsLZnUljdret5kWDQVR6Qh+oaW354zXN4h8/jpb ygQtlsaRd/7EZikZjIVaQS23jaYcNGoSuMTmKEu4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , Arnd Bergmann , "Martin K. Petersen" Subject: [PATCH 4.19 088/346] scsi: megaraid_sas: Check user-provided offsets Date: Mon, 28 Dec 2020 13:46:47 +0100 Message-Id: <20201228124924.055088871@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201228124919.745526410@linuxfoundation.org> References: <20201228124919.745526410@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann commit 381d34e376e3d9d27730fda8a0e870600e6c8196 upstream. It sounds unwise to let user space pass an unchecked 32-bit offset into a kernel structure in an ioctl. This is an unsigned variable, so checking the upper bound for the size of the structure it points into is sufficient to avoid data corruption, but as the pointer might also be unaligned, it has to be written carefully as well. While I stumbled over this problem by reading the code, I did not continue checking the function for further problems like it. Link: https://lore.kernel.org/r/20201030164450.1253641-2-arnd@kernel.org Fixes: c4a3e0a529ab ("[SCSI] MegaRAID SAS RAID: new driver") Cc: # v2.6.15+ Reviewed-by: Christoph Hellwig Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/megaraid/megaraid_sas_base.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -7192,7 +7192,7 @@ megasas_mgmt_fw_ioctl(struct megasas_ins int error = 0, i; void *sense = NULL; dma_addr_t sense_handle; - unsigned long *sense_ptr; + void *sense_ptr; u32 opcode = 0; memset(kbuff_arr, 0, sizeof(kbuff_arr)); @@ -7309,6 +7309,13 @@ megasas_mgmt_fw_ioctl(struct megasas_ins } if (ioc->sense_len) { + /* make sure the pointer is part of the frame */ + if (ioc->sense_off > + (sizeof(union megasas_frame) - sizeof(__le64))) { + error = -EINVAL; + goto out; + } + sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len, &sense_handle, GFP_KERNEL); if (!sense) { @@ -7316,12 +7323,11 @@ megasas_mgmt_fw_ioctl(struct megasas_ins goto out; } - sense_ptr = - (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off); + sense_ptr = (void *)cmd->frame + ioc->sense_off; if (instance->consistent_mask_64bit) - *sense_ptr = cpu_to_le64(sense_handle); + put_unaligned_le64(sense_handle, sense_ptr); else - *sense_ptr = cpu_to_le32(sense_handle); + put_unaligned_le32(sense_handle, sense_ptr); } /*