Messages in this thread Patch in this message | | | From | Xiaohui Zhang <> | Subject | [PATCH 1/1] scsi: Fix possible buffer overflows in storvsc_queuecommand | Date | Tue, 8 Dec 2020 21:19:18 +0800 |
| |
From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
storvsc_queuecommand() calls memcpy() without checking the destination size may trigger a buffer overflower, which a local user could use to cause denial of service or the execution of arbitrary code. Fix it by putting the length check before calling memcpy().
Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com> --- drivers/scsi/storvsc_drv.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 0c65fbd41..09b60a4c0 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1729,6 +1729,8 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) vm_srb->cdb_length = scmnd->cmd_len; + if (vm_srb->cdb_length > STORVSC_MAX_CMD_LEN) + vm_srb->cdb_length = STORVSC_MAX_CMD_LEN; memcpy(vm_srb->cdb, scmnd->cmnd, vm_srb->cdb_length); sgl = (struct scatterlist *)scsi_sglist(scmnd); -- 2.17.1
| |