diff mbox

[1/2] ses: tighten range checking in ses_enclosure_data_process()

Message ID 20151019101538.GA26688@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter Oct. 19, 2015, 10:15 a.m. UTC 
"len" has to be at least 12 because we need that space for the overall
descriptor, otherwise we end up reading beyond the end of the array and
KASan complains.  Later on we have some more range checking on desc_ptr
but we are checking the start of the "desc_ptr" buffer instead of the
end of the buffer (desc_ptr + 4).  Let's tighten that up as well.

Reported-by: "Berry Cheng ??(??)" <chengmiao.cj@alibaba-inc.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index dcb0d76..ff474c7 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -476,6 +476,8 @@  static void ses_enclosure_data_process(struct enclosure_device *edev,
 		goto simple_populate;
 
 	page7_len = len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
+	if (len < 12)
+		goto simple_populate;
 	/* add 1 for trailing '\0' we'll use */
 	buf = kzalloc(len + 1, GFP_KERNEL);
 	if (!buf)
@@ -504,15 +506,19 @@  static void ses_enclosure_data_process(struct enclosure_device *edev,
 			struct enclosure_component *ecomp;
 
 			if (desc_ptr) {
-				if (desc_ptr >= buf + page7_len) {
+				if (desc_ptr + 4 >= buf + page7_len) {
 					desc_ptr = NULL;
 				} else {
 					len = (desc_ptr[2] << 8) + desc_ptr[3];
 					desc_ptr += 4;
 					/* Add trailing zero - pushes into
 					 * reserved space */
-					desc_ptr[len] = '\0';
-					name = desc_ptr;
+					if (desc_ptr + len >= buf + page7_len) {
+						desc_ptr = NULL;
+					} else {
+						desc_ptr[len] = '\0';
+						name = desc_ptr;
+					}
 				}
 			}
 			if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||