lkml.org 
[lkml]   [2020]   [Dec]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/1] scsi: Fix possible buffer overflows in storvsc_queuecommand
Date
From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>

storvsc_queuecommand() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
---
drivers/scsi/storvsc_drv.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 0c65fbd41..09b60a4c0 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1729,6 +1729,8 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)

vm_srb->cdb_length = scmnd->cmd_len;

+ if (vm_srb->cdb_length > STORVSC_MAX_CMD_LEN)
+ vm_srb->cdb_length = STORVSC_MAX_CMD_LEN;
memcpy(vm_srb->cdb, scmnd->cmnd, vm_srb->cdb_length);

sgl = (struct scatterlist *)scsi_sglist(scmnd);
--
2.17.1
\
 
 \ /
  Last update: 2020-12-08 14:39    [W:1.769 / U:0.096 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site