Messages in this thread Patch in this message | | | From | "Andrea Parri (Microsoft)" <> | Subject | [PATCH 3/3] scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() | Date | Thu, 17 Dec 2020 21:33:21 +0100 |
| |
Check that the packet is of the expected size at least, don't copy data past the packet.
Reported-by: Saruhan Karademir <skarade@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org --- drivers/scsi/storvsc_drv.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 8714355cb63e7..4b8bde2750fac 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1250,6 +1250,12 @@ static void storvsc_on_channel_callback(void *context) request = (struct storvsc_cmd_request *) ((unsigned long)desc->trans_id); + if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) - + stor_device->vmscsi_size_delta) { + dev_err(&device->device, "Invalid packet len\n"); + continue; + } + if (request == &stor_device->init_request || request == &stor_device->reset_request) { memcpy(&request->vstor_packet, packet, -- 2.25.1
| |