From patchwork Tue Sep 8 21:36:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 249379 Delivered-To: patch@linaro.org Received: by 2002:a92:5b9c:0:0:0:0:0 with SMTP id c28csp4917778ilg; Tue, 8 Sep 2020 14:38:13 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwNbYZ0c41MIuI+GVa28za/t5zg3Bxbg6hs0lEq5qxQU3YLQk9B/OG4GZnxfepmqQjnBMPe X-Received: by 2002:a17:906:5e59:: with SMTP id b25mr513723eju.414.1599601092877; Tue, 08 Sep 2020 14:38:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1599601092; cv=none; d=google.com; s=arc-20160816; b=IkCC3NZdKSyVISPR1lAr1NlQNwYtZ1+EvrOAb/y5U0NwPxxjLoThAwdPjtKQfav3Uq 2umsdDAyAIcDV3CF9cJUnND9T1atmNKJU/dO/XiVdObxMqJFyfFQfBVLbKBZIgLVISF+ czySrcoRDce/eGQ1spv2sI/CJ2mk07d1YgL8qbAt9T1caZxi6ej03A09SVZc5vY+iC5R pdrjqdLgUw4Ws6qMLHVZmbTTRan7X07GQzzOaybsVmn9Ic2sMblE9DtAuvsGk6ngk+ua pZGDKCxEXCt8I5qeFvhupDDKyOIdmytFocBhy1zIQvJhHx8JgtyB6JxUAKmly0VhFpzt SizQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=v+kuvSmF9UMwrUqWBTsHcYjUcEV+1lGRdNBYCUtZS84=; b=cfB3F6FKdGlREVdFjhc0yjxOl2NUS4JJciY12kStuCQdTjCUWDCW4FVc+k+zy4Kcut a7nDNjeE0ThakO0Ds2y00aEoMC66unK3YztyZupk1+fLmasNainBZE8O4HuQGykwoVZY fkD+kiRm/End8bdL/zyosetbvw5MHB2S8y5QaiqUOl4jtimS8qcTH6H9o8RM2bk/W03J kNRSs2NefZHQ9aqZ/ZqIFU7bxtO6FsM+MPfkwM1fBYvGx3Jpl9DVdPTdm2Fx163FOzpT 5wDBFxYZwuvOYyz5R5E6CjOFnk0XIBoPfBr1tD0PEk1kjHd430WCIhyHNO1PilmKBG/Y PTWQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id dn25si195813edb.268.2020.09.08.14.38.12; Tue, 08 Sep 2020 14:38:12 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729251AbgIHViI (ORCPT + 15 others); Tue, 8 Sep 2020 17:38:08 -0400 Received: from mout.kundenserver.de ([212.227.126.187]:48247 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728647AbgIHViG (ORCPT ); Tue, 8 Sep 2020 17:38:06 -0400 Received: from threadripper.lan ([149.172.98.151]) by mrelayeu.kundenserver.de (mreue012 [212.227.15.129]) with ESMTPA (Nemesis) id 1MYcy3-1k1cR223AB-00Vdt2; Tue, 08 Sep 2020 23:37:51 +0200 From: Arnd Bergmann To: Kashyap Desai , Sumit Saxena , Shivasharan S , "James E.J. Bottomley" , "Martin K. Petersen" Cc: hch@infradead.org, Arnd Bergmann , stable@vger.kernel.org, Anand Lodnoor , Chandrakanth Patil , Hannes Reinecke , megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/3] scsi: megaraid_sas: check user-provided offsets Date: Tue, 8 Sep 2020 23:36:22 +0200 Message-Id: <20200908213715.3553098-2-arnd@arndb.de> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200908213715.3553098-1-arnd@arndb.de> References: <20200908213715.3553098-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:ySbOIHgYtcPCmDgKFJWQFKZzEpToys/t268vTJCmMrSGnITz77V xl5OAKtcncF9BqiN5rvTw8tDPiLZYdRujzLHGB3QOrcmuo53qW/gJlHNEKphYn0nYEAXhPt wpToVMv/Hyxv9/DTHreJq0bmwBQYh7+jRsM64wZyVdDwgI9bJDS3FXlC0d2H6XnCCEwTBFq TIT3+6Lq7J3BhphtiWgmA== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1; V03:K0:Yd64zGE+X4E=:xdJ2yudVuGKJoDcfhgjFlS 6vAp1av9q/HZUaGSmDDq2yVfr/RppdX2z8N6ZJ5lY2HgBs/5B6bYzlDL9TfTglgoM8utkS5ri LySDmoFHheBCtm9M8k4/ooxgV88XhwSikIF2dp9EA+D7I24mnn8Tt0/WjBhW06KDH9hggWY6Y +YkkyIOwgyECscXQTgnXQ1zwdtj9JmcViO/If2siZI8LJ7STwkvubJNV8alGmW6N9JQAebxyi +PJQcXFP3iUst6slq7UEpbuuVUwtJSs6LcfsGYi1N3CGgb8QGpALMxT9vfPnG94OTkpE+JIsT Av4GT0xdy67csPFsRqXoTlPxX2qLsyTptj4ytlrClRvlvf7EYKH4v1SE/yNw8ziCGovE0/Awv EIpcsSLVZMWrK8ZnFlPyEUeAnSjb0CO5QmBijC18tXh1HY8q5JCZupbYoqwx5b/gZpLrm10iV zQ+Qg5sA0ROBOHPVY8TeTXp8e2yzxacvkvW84pc0lLRiNxOVQlSphhS8thj4vIiq748FVpRYy /QI99VdO0M18FPyuFo76jTH9wy2KjsFQ7KZgm+UL/EmK6x56uZU6nUG6s06seNPMihd9iFPxZ w3UPXEcGq8qjLYsffUOUdJHGH0NvYYOr/YkbfySXLOs5FUWTufkFHSYB/5/RtSdynotBKJdHI Dz3++XKwS4GU8ynCnIBshzjCQR40yhThSfWSj6v81PLN+YqFgH85OtfJ5TOYB38i7aVy0UIzz kBRhA6g6GAaxJdkgpuDiGuor938PcPxaEnF1afRNuTLLoN3E4652cGMNWwTQU1u4Ia4fVPIYu xJTKNZTzRbWC78+oHOTfSNqumIpv1BFE3vb6Gnb2HUj21/jE51eWSexkqjNdiEbbguAFvvf Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org It sounds unwise to let user space pass an unchecked 32-bit offset into a kernel structure in an ioctl. This is an unsigned variable, so checking the upper bound for the size of the structure it points into is sufficient to avoid data corruption, but as the pointer might also be unaligned, it has to be written carefully as well. While I stumbled over this problem by reading the code, I did not continue checking the function for further problems like it. Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann --- drivers/scsi/megaraid/megaraid_sas_base.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) -- 2.27.0 Reviewed-by: Christoph Hellwig diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c index 861f7140f52e..c3de69f3bee8 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -8095,7 +8095,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance, int error = 0, i; void *sense = NULL; dma_addr_t sense_handle; - unsigned long *sense_ptr; + void *sense_ptr; u32 opcode = 0; int ret = DCMD_SUCCESS; @@ -8218,6 +8218,12 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance, } if (ioc->sense_len) { + /* make sure the pointer is part of the frame */ + if (ioc->sense_off > (sizeof(union megasas_frame) - sizeof(__le64))) { + error = -EINVAL; + goto out; + } + sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len, &sense_handle, GFP_KERNEL); if (!sense) { @@ -8225,12 +8231,11 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance, goto out; } - sense_ptr = - (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off); + sense_ptr = (void *)cmd->frame + ioc->sense_off; if (instance->consistent_mask_64bit) - *sense_ptr = cpu_to_le64(sense_handle); + put_unaligned_le64(sense_handle, sense_ptr); else - *sense_ptr = cpu_to_le32(sense_handle); + put_unaligned_le32(sense_handle, sense_ptr); } /*