From patchwork Fri Oct 30 16:44:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 320007 Delivered-To: patch@linaro.org Received: by 2002:a92:7b12:0:0:0:0:0 with SMTP id w18csp1572193ilc; Fri, 30 Oct 2020 09:45:30 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxMYf24u4gbvHkm7EVHa2z+GEY0dIQ+FCtuA/UQJ/97lvtkxSheYihCWbeAdXqtpIAyYKoe X-Received: by 2002:aa7:ccc8:: with SMTP id y8mr3459394edt.325.1604076329963; Fri, 30 Oct 2020 09:45:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1604076329; cv=none; d=google.com; s=arc-20160816; b=ga50BwsHd56AJXvs+A5Y9ZYX7FyjsksDwxmoeFLzOi7jZx1cIrOye0vkbjHekv6JmD 8qRgNjr8NGWifKUq5sfV+Y4ZBtYfi7kwGPk4hIhpeV9QKl19eg1UYVenFgB23/KvCkz6 uWQhxfMtqWdyxete2hYLUJ0jtNvTnJCf9L0fFVDjmFmO7hAtkkHTPu0No532e3hBevIk M70Nh2CdTFmOiV4joHK+/A8hZTsNvU577/0gU7ZpeO73057qL+FRyoetPBGIFnndtffm jIsgV+Kxy5LA9b3Eq4jDIoawQPkpCZfM5pQNUoF4FtYY/Z0ckBHNY8Tn0NGPtjTju6UE hY+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=M5n+lRxcBqIJSaYK65EIHTBvljczEYjQ8p5gOEg5uP8=; b=BEqxC3o2hfsbQ0eoo2cxMFRoi/hGSIV9SfnmNrW0hyQpdNhtZDqbgvXIyOVB74vUHQ JdhbLQq4L9wuuYcdm0Nsy4XMol4iqMdTDuu+qBU95SRoOyyiH/GFy9CGQ4WX3vr5F1Pp cpL63R703MzNoqI8OXnytznPbJZHF/v499816Hh9M0EbOB7groPTxjhwQrHYNDEm6fSW 3h57BQppRlF3UhEQihgyCzMDaP41GXECs3ZDbVdFXUj4mgEP5l9KyHiQJBvJJlVARKmM D/TO+eZ7AZCAsekhUkZckdPqjpueX8TbDnpsqFUcKhAmhJimmMKuGFGAj8PfOnVJelTg ze4w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=MePavGne; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id n13si4622912eji.447.2020.10.30.09.45.29; Fri, 30 Oct 2020 09:45:29 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=MePavGne; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727083AbgJ3Qp3 (ORCPT + 15 others); Fri, 30 Oct 2020 12:45:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:58282 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726063AbgJ3Qp3 (ORCPT ); Fri, 30 Oct 2020 12:45:29 -0400 Received: from localhost.localdomain (HSI-KBW-46-223-126-90.hsi.kabel-badenwuerttemberg.de [46.223.126.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9313820756; Fri, 30 Oct 2020 16:45:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604076328; bh=TJe5PncsoCY6sMxrZnBZwktnNCtq0wI8fPX7anNMPFc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MePavGne+C4z1ea1qvc/6xxO6fdpqM6LNmpMPGnPJi9yV5jxBasOYaDKB1jY5sxX0 tmWQky1L5hfcwgdactK/SRRVGHjYMFxJ1gw5Vs7aR0H/F+U3okfzVzLrXlIOs/zUaY 2zMRkEFRXDm7ND0W4GN+aYBWmIlJ2u2lsffXmH4M= From: Arnd Bergmann To: Kashyap Desai , Sumit Saxena , Shivasharan S , "James E.J. Bottomley" , "Martin K. Petersen" Cc: Arnd Bergmann , stable@vger.kernel.org, Christoph Hellwig , Anand Lodnoor , Hannes Reinecke , megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 2/3] scsi: megaraid_sas: check user-provided offsets Date: Fri, 30 Oct 2020 17:44:20 +0100 Message-Id: <20201030164450.1253641-2-arnd@kernel.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20201030164450.1253641-1-arnd@kernel.org> References: <20201030164450.1253641-1-arnd@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann It sounds unwise to let user space pass an unchecked 32-bit offset into a kernel structure in an ioctl. This is an unsigned variable, so checking the upper bound for the size of the structure it points into is sufficient to avoid data corruption, but as the pointer might also be unaligned, it has to be written carefully as well. While I stumbled over this problem by reading the code, I did not continue checking the function for further problems like it. Cc: # v2.6.15+ Fixes: c4a3e0a529ab ("[SCSI] MegaRAID SAS RAID: new driver") Reviewed-by: Christoph Hellwig Signed-off-by: Arnd Bergmann --- drivers/scsi/megaraid/megaraid_sas_base.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) -- 2.27.0 diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c index 41cd66fc7d81..b1b9a8823c8c 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -8134,7 +8134,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance, int error = 0, i; void *sense = NULL; dma_addr_t sense_handle; - unsigned long *sense_ptr; + void *sense_ptr; u32 opcode = 0; int ret = DCMD_SUCCESS; @@ -8257,6 +8257,12 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance, } if (ioc->sense_len) { + /* make sure the pointer is part of the frame */ + if (ioc->sense_off > (sizeof(union megasas_frame) - sizeof(__le64))) { + error = -EINVAL; + goto out; + } + sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len, &sense_handle, GFP_KERNEL); if (!sense) { @@ -8264,12 +8270,11 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance, goto out; } - sense_ptr = - (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off); + sense_ptr = (void *)cmd->frame + ioc->sense_off; if (instance->consistent_mask_64bit) - *sense_ptr = cpu_to_le64(sense_handle); + put_unaligned_le64(sense_handle, sense_ptr); else - *sense_ptr = cpu_to_le32(sense_handle); + put_unaligned_le32(sense_handle, sense_ptr); } /*