android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses

Browse Source 
commit db95d4df71cb55506425b6e4a5f8d68e3a765b63 upstream.

Sanitize possible addl_desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().

Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Tomas Henzl 2023-02-02 17:24:49 +01:00 committed by Greg Kroah-Hartman
parent 467afb1dd6
commit 8e454aba72
1 changed files with 26 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
drivers/scsi/ses.c
View File

@ -433,8 +433,8 @@ int ses_match_host(struct enclosure_device *edev, void *data)
}
#endif /* 0 */
static void ses_process_descriptor(struct enclosure_component *ecomp,
unsigned char *desc)
static int ses_process_descriptor(struct enclosure_component *ecomp,
unsigned char *desc, int max_desc_len)
{
int eip = desc[0] & 0x10;
int invalid = desc[0] & 0x80;
@ -445,22 +445,32 @@ static void ses_process_descriptor(struct enclosure_component *ecomp,
unsigned char *d;
if (invalid)
return;
return 0;
switch (proto) {
case SCSI_PROTOCOL_FCP:
if (eip) {
if (max_desc_len <= 7)
return 1;
d = desc + 4;
slot = d[3];
}
break;
case SCSI_PROTOCOL_SAS:
if (eip) {
if (max_desc_len <= 27)
return 1;
d = desc + 4;
slot = d[3];
d = desc + 8;
} else
} else {
if (max_desc_len <= 23)
return 1;
d = desc + 4;
}
/* only take the phy0 addr */
addr = (u64)d[12] << 56 |
(u64)d[13] << 48 |
@ -477,6 +487,8 @@ static void ses_process_descriptor(struct enclosure_component *ecomp,
}
ecomp->slot = slot;
scomp->addr = addr;
return 0;
}
struct efd {
@ -549,7 +561,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
/* skip past overall descriptor */
desc_ptr += len + 4;
}
if (ses_dev->page10)
if (ses_dev->page10 && ses_dev->page10_len > 9)
addl_desc_ptr = ses_dev->page10 + 8;
type_ptr = ses_dev->page1_types;
components = 0;
@ -557,6 +569,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
for (j = 0; j < type_ptr[1]; j++) {
char *name = NULL;
struct enclosure_component *ecomp;
int max_desc_len;
if (desc_ptr) {
if (desc_ptr >= buf + page7_len) {
@ -583,10 +596,14 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
ecomp = &edev->component[components++];
if (!IS_ERR(ecomp)) {
if (addl_desc_ptr)
ses_process_descriptor(
ecomp,
addl_desc_ptr);
if (addl_desc_ptr) {
max_desc_len = ses_dev->page10_len -
(addl_desc_ptr - ses_dev->page10);
if (ses_process_descriptor(ecomp,
addl_desc_ptr,
max_desc_len))
addl_desc_ptr = NULL;
}
if (create)
enclosure_component_register(
ecomp);