Messages in this thread Patch in this message | | | Date | Thu, 23 Feb 2006 02:02:57 +0100 (CET) | From | Stefan Richter <> | Subject | [PATCH 1/2] sd: fix memory corruption by sd_read_cache_type |
| |
sd: fix memory corruption by sd_read_cache_type
Let sd check more thoroughly before using mode_sense responses for data length calculation. Fixes memory corruption ("slab error in cache_free_debugcheck") or kernel panic when buggy disks are connected, notably Initio SBP-2 bridges. http://bugzilla.kernel.org/show_bug.cgi?id=6114 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182005
Taken from a patch by Al Viro <viro@ftp.linux.org.uk>. http://marc.theaimsgroup.com/?l=linux-scsi&m=114055884611429
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> --- Patch is applicable to 2.6.14, 2.6.15, 2.6.16.
Index: linux-2.6.16-rc4/drivers/scsi/sd.c =================================================================== --- linux-2.6.16-rc4.orig/drivers/scsi/sd.c 2006-02-22 22:27:42.000000000 +0100 +++ linux-2.6.16-rc4/drivers/scsi/sd.c 2006-02-22 22:29:10.000000000 +0100 @@ -1342,6 +1342,8 @@ sd_read_cache_type(struct scsi_disk *sdk /* Take headers and block descriptors into account */ len += data.header_length + data.block_descriptor_length; + if (len > 512) + goto bad_sense; /* Get the data */ res = sd_do_mode_sense(sdp, dbd, modepage, buffer, len, &data, &sshdr); @@ -1354,6 +1356,12 @@ sd_read_cache_type(struct scsi_disk *sdk int ct = 0; int offset = data.header_length + data.block_descriptor_length; + if (offset >= 512 - 2) { + printk(KERN_ERR "%s: malformed MODE SENSE response", + diskname); + goto defaults; + } + if ((buffer[offset] & 0x3f) != modepage) { printk(KERN_ERR "%s: got wrong page\n", diskname); goto defaults;
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |