| Message ID | 20201118145348.109879-1-parri.andrea@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() | expand |
On Wed, 18 Nov 2020 15:53:48 +0100, Andrea Parri (Microsoft) wrote: > Check that the packet is of the expected size at least, don't copy > data past the packet. Applied to 5.10/scsi-fixes, thanks! [1/1] scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() https://git.kernel.org/mkp/scsi/c/3b8c72d076c4 -- Martin K. Petersen Oracle Linux Engineering
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 331a33a04f1ad..629a46a0bab6e 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1270,6 +1270,11 @@ static void storvsc_on_channel_callback(void *context) request = (struct storvsc_cmd_request *)(unsigned long)cmd_rqst; + if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) - vmscsi_size_delta) { + dev_err(&device->device, "Invalid packet len\n"); + continue; + } + if (request == &stor_device->init_request || request == &stor_device->reset_request) { memcpy(&request->vstor_packet, packet,
Check that the packet is of the expected size at least, don't copy data past the packet. Reported-by: Saruhan Karademir <skarade@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org --- Based on hyperv-next. drivers/scsi/storvsc_drv.c | 5 +++++ 1 file changed, 5 insertions(+)