lkml.org 
[lkml]   [2020]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2 1/1] hisi_sas: Fix possible buffer overflows in prep_ssp_v3_hw
    Date
    From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>

    prep_ssp_v3_hw() calls memcpy() without checking the destination
    size may trigger a buffer overflower.

    buf_cmd should be a ssp_tmf_iu struct through the analysis of
    the command below:
    buf_cmd = hisi_sas_cmd_hdr_addr_mem(slot) +
    sizeof(struct ssp_frame_hdr);

    Then buf_cmd + 12 should point to tag, so the length parameter
    of memcpy() should not exceed sizeof(__be16)+sizeof(u8)*14):
    struct ssp_tmf_iu {
    u8 lun[8];
    u16 _r_a;
    u8 tmf;
    u8 _r_b;
    __be16 tag;
    u8 _r_c[14];
    } __attribute__ ((packed));

    Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
    ---
    drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
    index 7133ca859..d02831c17 100644
    --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
    +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
    @@ -1267,7 +1267,9 @@ static void prep_ssp_v3_hw(struct hisi_hba *hisi_hba,
    memcpy(buf_cmd, &task->ssp_task.LUN, 8);
    if (!tmf) {
    buf_cmd[9] = ssp_task->task_attr | (ssp_task->task_prio << 3);
    - memcpy(buf_cmd + 12, scsi_cmnd->cmnd, scsi_cmnd->cmd_len);
    + memcpy(buf_cmd + 12, scsi_cmnd->cmnd,
    + min_t(unsigned short, scsi_cmnd->cmd_len,
    + sizeof(__be16) + sizeof(u8) * 14));
    } else {
    buf_cmd[10] = tmf->tmf;
    switch (tmf->tmf) {
    --
    2.17.1
    \
     
     \ /
      Last update: 2020-12-09 15:26    [W:2.947 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site