From patchwork Mon Oct 19 10:15:38 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 7434931 Return-Path: X-Original-To: patchwork-linux-scsi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id D841E9F36A for ; Mon, 19 Oct 2015 10:16:02 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EAD242045B for ; Mon, 19 Oct 2015 10:16:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 08CD520457 for ; Mon, 19 Oct 2015 10:16:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751691AbbJSKQA (ORCPT ); Mon, 19 Oct 2015 06:16:00 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:19231 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750876AbbJSKP7 (ORCPT ); Mon, 19 Oct 2015 06:15:59 -0400 Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id t9JAFjO2006288 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 19 Oct 2015 10:15:45 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0021.oracle.com (8.13.8/8.13.8) with ESMTP id t9JAFjkE019789 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 19 Oct 2015 10:15:45 GMT Received: from abhmp0002.oracle.com (abhmp0002.oracle.com [141.146.116.8]) by userv0122.oracle.com (8.13.8/8.13.8) with ESMTP id t9JAFjlx001323; Mon, 19 Oct 2015 10:15:45 GMT Received: from mwanda (/154.0.139.178) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 19 Oct 2015 03:15:44 -0700 Date: Mon, 19 Oct 2015 13:15:38 +0300 From: Dan Carpenter To: "James E.J. Bottomley" Cc: linux-scsi@vger.kernel.org, security , =?utf-8?B?56iL5ZCbKOaIkOa3vCk=?= , throber3 Subject: [patch 1/2] ses: tighten range checking in ses_enclosure_data_process() Message-ID: <20151019101538.GA26688@mwanda> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <----An------QYmAn$4202951b-482d-4d92-98c2-3466de737b40@alibaba-inc.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP "len" has to be at least 12 because we need that space for the overall descriptor, otherwise we end up reading beyond the end of the array and KASan complains. Later on we have some more range checking on desc_ptr but we are checking the start of the "desc_ptr" buffer instead of the end of the buffer (desc_ptr + 4). Let's tighten that up as well. Reported-by: "Berry Cheng ??(??)" Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c index dcb0d76..ff474c7 100644 --- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -476,6 +476,8 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, goto simple_populate; page7_len = len = (hdr_buf[2] << 8) + hdr_buf[3] + 4; + if (len < 12) + goto simple_populate; /* add 1 for trailing '\0' we'll use */ buf = kzalloc(len + 1, GFP_KERNEL); if (!buf) @@ -504,15 +506,19 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, struct enclosure_component *ecomp; if (desc_ptr) { - if (desc_ptr >= buf + page7_len) { + if (desc_ptr + 4 >= buf + page7_len) { desc_ptr = NULL; } else { len = (desc_ptr[2] << 8) + desc_ptr[3]; desc_ptr += 4; /* Add trailing zero - pushes into * reserved space */ - desc_ptr[len] = '\0'; - name = desc_ptr; + if (desc_ptr + len >= buf + page7_len) { + desc_ptr = NULL; + } else { + desc_ptr[len] = '\0'; + name = desc_ptr; + } } } if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||