lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 358/389] scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
    Date
    From: James Smart <jsmart2021@gmail.com>

    [ Upstream commit f8191d40aa612981ce897e66cda6a88db8df17bb ]

    Malformed user input to debugfs results in buffer overflow crashes. Adapt
    input string lengths to fit within internal buffers, leaving space for NULL
    terminators.

    Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com
    Co-developed-by: Justin Tee <justin.tee@broadcom.com>
    Signed-off-by: Justin Tee <justin.tee@broadcom.com>
    Signed-off-by: James Smart <jsmart2021@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/lpfc/lpfc_debugfs.c | 20 ++++++++++----------
    1 file changed, 10 insertions(+), 10 deletions(-)

    diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
    index e15bb3dfe995..69551132f304 100644
    --- a/drivers/scsi/lpfc/lpfc_debugfs.c
    +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
    @@ -2402,8 +2402,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf,
    struct lpfc_sli4_hdw_queue *qp;
    struct lpfc_multixri_pool *multixri_pool;

    - if (nbytes > 64)
    - nbytes = 64;
    + if (nbytes > sizeof(mybuf) - 1)
    + nbytes = sizeof(mybuf) - 1;

    /* Protect copy from user */
    if (!access_ok(buf, nbytes))
    @@ -2487,8 +2487,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
    if (!phba->targetport)
    return -ENXIO;

    - if (nbytes > 64)
    - nbytes = 64;
    + if (nbytes > sizeof(mybuf) - 1)
    + nbytes = sizeof(mybuf) - 1;

    memset(mybuf, 0, sizeof(mybuf));

    @@ -2629,8 +2629,8 @@ lpfc_debugfs_nvmektime_write(struct file *file, const char __user *buf,
    char mybuf[64];
    char *pbuf;

    - if (nbytes > 64)
    - nbytes = 64;
    + if (nbytes > sizeof(mybuf) - 1)
    + nbytes = sizeof(mybuf) - 1;

    memset(mybuf, 0, sizeof(mybuf));

    @@ -2757,8 +2757,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
    char mybuf[64];
    char *pbuf;

    - if (nbytes > 63)
    - nbytes = 63;
    + if (nbytes > sizeof(mybuf) - 1)
    + nbytes = sizeof(mybuf) - 1;

    memset(mybuf, 0, sizeof(mybuf));

    @@ -2863,8 +2863,8 @@ lpfc_debugfs_cpucheck_write(struct file *file, const char __user *buf,
    char *pbuf;
    int i, j;

    - if (nbytes > 64)
    - nbytes = 64;
    + if (nbytes > sizeof(mybuf) - 1)
    + nbytes = sizeof(mybuf) - 1;

    memset(mybuf, 0, sizeof(mybuf));

    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-23 14:04    [W:2.714 / U:0.268 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site