Messages in this thread | | | Date | Sat, 12 Sep 2020 08:20:53 +0100 | From | Christoph Hellwig <> | Subject | Re: [PATCH 2/3] scsi: megaraid_sas: check user-provided offsets |
| |
On Tue, Sep 08, 2020 at 11:36:22PM +0200, Arnd Bergmann wrote: > It sounds unwise to let user space pass an unchecked 32-bit > offset into a kernel structure in an ioctl. This is an unsigned > variable, so checking the upper bound for the size of the structure > it points into is sufficient to avoid data corruption, but as > the pointer might also be unaligned, it has to be written carefully > as well. > > While I stumbled over this problem by reading the code, I did not > continue checking the function for further problems like it.
Oh, yikes!
> > Cc: stable@vger.kernel.org
What about a Fixes tag instead?
> if (ioc->sense_len) { > + /* make sure the pointer is part of the frame */ > + if (ioc->sense_off > (sizeof(union megasas_frame) - sizeof(__le64))) {
No need for the inner braces and please avoid over 80 char lines.
Otherwise looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
| |