android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4df82c6d6e
android_kernel_xiaomi_sm8450/drivers/scsi
History
Lin Ma 4df82c6d6e scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() 
[ Upstream commit ce51c817008450ef4188471db31639d42d37a5e1 ]

The functions iscsi_if_set_param() and iscsi_if_set_host_param() convert an
nlattr payload to type char* and then call C string handling functions like
sscanf and kstrdup:

  char *data = (char*)ev + sizeof(*ev);
  ...
  sscanf(data, "%d", &value);

However, since the nlattr is provided by the user-space program and the
nlmsg skb is allocated with GFP_KERNEL instead of GFP_ZERO flag (see
netlink_alloc_large_skb() in netlink_sendmsg()), dirty data on the heap can
lead to an OOB access for those string handling functions.

By investigating how the bug is introduced, we find it is really
interesting as the old version parsing code starting from commit
fd7255f51a ("[SCSI] iscsi: add sysfs attrs for uspace sync up") treated
the nlattr as integer bytes instead of string and had length check in
iscsi_copy_param():

  if (ev->u.set_param.len != sizeof(uint32_t))
    BUG();

But, since the commit a54a52caad ("[SCSI] iscsi: fixup set/get param
functions"), the code treated the nlattr as C string while forgetting to
add any strlen checks(), opening the possibility of an OOB access.

Fix the potential OOB by adding the strlen() check before accessing the
buf. If the data passes this check, all low-level set_param handlers can
safely treat this buf as legal C string.

Fixes: fd7255f51a ("[SCSI] iscsi: add sysfs attrs for uspace sync up")
Fixes: 1d9bf13a9c ("[SCSI] iscsi class: add iscsi host set param event")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Link: https://lore.kernel.org/r/20230723075820.3713119-1-linma@zju.edu.cn
Reviewed-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-19 12:20:17 +02:00
..
aacraid scsi: aacraid: Improve compat_ioctl handlers 2020-12-30 11:53:02 +01:00
aic7xxx scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 2021-07-25 14:36:16 +02:00
aic94xx scsi: libsas: Introduce more SAM status code aliases in enum exec_status 2023-09-19 12:20:16 +02:00
arcmsr scsi: arcmsr: Fix doorbell status being updated late on ARC-1886 2021-07-20 16:05:39 +02:00
arm SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
be2iscsi scsi: iscsi: Rel ref after iscsi_lookup_endpoint() 2022-04-20 09:23:16 +02:00
bfa scsi: bfa: Replace snprintf() with sysfs_emit() 2022-04-13 21:00:55 +02:00
bnx2fc scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe 2022-02-08 18:30:39 +01:00
bnx2i scsi: iscsi: Rel ref after iscsi_lookup_endpoint() 2022-04-20 09:23:16 +02:00
csiostor scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() 2021-11-18 14:04:18 +01:00
cxgbi scsi: iscsi: Rel ref after iscsi_lookup_endpoint() 2022-04-20 09:23:16 +02:00
cxlflash powerpc updates for 5.10 2020-10-16 12:21:15 -07:00
device_handler scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() 2023-04-05 11:23:33 +02:00
dpt
esas2r SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
fcoe scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails 2023-01-14 10:15:52 +01:00
fnic scsi: fnic: Fix memleak in vnic_dev_init_devcmd2 2021-02-07 15:37:14 +01:00
hisi_sas scsi: hisi_sas: Fix normally completed I/O analysed as failed 2023-09-19 12:20:16 +02:00
ibmvscsi scsi: ibmvfc: Avoid path failures during live migration 2022-12-02 17:39:58 +01:00
ibmvscsi_tgt scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 2022-04-20 09:23:21 +02:00
isci scsi: libsas: Introduce more SAM status code aliases in enum exec_status 2023-09-19 12:20:16 +02:00
libfc scsi: libfc: Fix use after free in fc_exch_abts_resp() 2022-04-13 21:00:59 +02:00
libsas scsi: libsas: Introduce more SAM status code aliases in enum exec_status 2023-09-19 12:20:16 +02:00
lpfc scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow 2023-05-30 12:57:48 +01:00
megaraid scsi: megaraid_sas: Fix fw_crash_buffer_show() 2023-04-26 11:27:37 +02:00
mpt3sas scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() 2023-03-22 13:29:56 +01:00
mvsas scsi: libsas: Introduce more SAM status code aliases in enum exec_status 2023-09-19 12:20:16 +02:00
pcmcia scsi: fdomain: Fix error return code in fdomain_probe() 2021-09-18 13:40:14 +02:00
pm8001 scsi: libsas: Introduce more SAM status code aliases in enum exec_status 2023-09-19 12:20:16 +02:00
qedf scsi: qedf: Fix firmware halt over suspend and resume 2023-08-16 18:21:03 +02:00
qedi scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock 2023-09-19 12:20:05 +02:00
qla2xxx scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue 2023-07-27 08:44:33 +02:00
qla4xxx scsi: iscsi: Rel ref after iscsi_lookup_endpoint() 2022-04-20 09:23:16 +02:00
smartpqi scsi: smartpqi: Fix DMA direction for RAID requests 2022-08-21 15:15:59 +02:00
snic scsi: snic: Fix double free in snic_tgt_create() 2023-08-30 16:23:18 +02:00
sym53c8xx_2 SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
ufs scsi: ufs: core: Add soft dependency on governor_simpleondemand 2023-04-05 11:23:38 +02:00
.gitignore
3w-9xxx.c scsi: 3w-9xxx: Avoid disabling device if failing to enable it 2022-10-26 13:25:52 +02:00
3w-9xxx.h
3w-sas.c
3w-sas.h
3w-xxxx.c scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() 2023-07-27 08:43:56 +02:00
3w-xxxx.h
53c700_d.h_shipped
53c700.c scsi: 53c700: Check that command slot is not NULL 2023-08-16 18:21:03 +02:00
53c700.h
53c700.scr
a100u2w.c
a100u2w.h
a2091.c
a2091.h
a3000.c
a3000.h
a4000t.c
advansys.c scsi: advansys: Fix kernel pointer leak 2021-11-26 10:39:10 +01:00
aha152x.c scsi: aha152x: Fix aha152x_setup() __setup handler return value 2022-04-13 21:00:58 +02:00
aha152x.h
aha1542.c
aha1542.h
aha1740.c
aha1740.h
am53c974.c
atari_scsi.c
atp870u.c
atp870u.h
BusLogic.c scsi: BusLogic: Fix missing pr_cont() use 2021-09-18 13:40:35 +02:00
BusLogic.h scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic 2021-06-03 09:00:43 +02:00
bvme6000_scsi.c
ch.c
constants.c
dc395x.c scsi: dc395x: Fix a missing check on list iterator 2022-06-09 10:21:24 +02:00
dc395x.h
dmx3191d.c
dpt_i2o.c scsi: dpt_i2o: Do not process completions with invalid addresses 2023-06-09 10:30:18 +02:00
dpti.h scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD) 2023-06-09 10:30:18 +02:00
esp_scsi.c
esp_scsi.h
fdomain_isa.c
fdomain_pci.c
fdomain.c
fdomain.h
FlashPoint.c scsi: FlashPoint: Rename si_flags field 2021-07-14 16:56:40 +02:00
g_NCR5380.c
gdth_ioctl.h
gdth_proc.c
gdth_proc.h
gdth.c scsi: gdth: Make option_setup() static 2020-10-07 21:48:28 -04:00
gdth.h
gvp11.c
gvp11.h
hosts.c scsi: core: Fix a procfs host directory removal regression 2023-03-22 13:29:57 +01:00
hpsa_cmd.h
hpsa.c scsi: hpsa: Fix allocation size for scsi_host_alloc() 2023-02-01 08:23:21 +01:00
hpsa.h
hptiop.c
hptiop.h
imm.c
imm.h
initio.c scsi: initio: Use module_pci_driver() to simplify the code 2020-10-07 21:48:28 -04:00
initio.h
ipr.c scsi: ipr: Work around fortify-string warning 2023-03-11 16:40:14 +01:00
ipr.h
ips.c
ips.h
iscsi_boot_sysfs.c
iscsi_tcp.c scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() 2023-04-20 12:10:23 +02:00
iscsi_tcp.h scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() 2022-10-26 13:25:37 +02:00
jazz_esp.c scsi: jazz_esp: Add IRQ check 2021-05-14 09:50:27 +02:00
Kconfig scsi: dpt_i2o: Do not process completions with invalid addresses 2023-06-09 10:30:18 +02:00
lasi700.c
libiscsi_tcp.c
libiscsi.c scsi: iscsi: Stop queueing during ep_disconnect 2022-04-20 09:23:15 +02:00
mac53c94.c
mac53c94.h
mac_esp.c
mac_scsi.c
Makefile
megaraid.c scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS 2023-05-17 11:47:49 +02:00
megaraid.h
mesh.c
mesh.h
mvme16x_scsi.c
mvme147.c
mvme147.h
mvumi.c
mvumi.h
myrb.c scsi: myrb: Fix up null pointer access on myrb_cleanup() 2022-06-14 18:32:43 +02:00
myrb.h
myrs.c scsi: myrs: Fix crash in error case 2022-02-16 12:54:20 +01:00
myrs.h
ncr53c8xx.c
ncr53c8xx.h
NCR5380.c
NCR5380.h
nsp32_debug.c
nsp32_io.h
nsp32.c
nsp32.h
pmcraid.c scsi: pmcraid: Fix missing resource cleanup in error case 2022-06-22 14:13:15 +02:00
pmcraid.h
ppa.c
ppa.h
ps3rom.c
qla1280.c
qla1280.h
qlogicfas408.c
qlogicfas408.h
qlogicfas.c
qlogicpti.c SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
qlogicpti.h
raid_class.c scsi: core: raid_class: Remove raid_component_add() 2023-08-30 16:23:18 +02:00
script_asm.pl
scsi_common.c
scsi_debug.c scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() 2023-01-14 10:15:52 +01:00
scsi_debugfs.c scsi: core: Show SCMD_LAST in text form 2022-01-27 10:54:29 +01:00
scsi_debugfs.h
scsi_devinfo.c scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR 2023-04-05 11:23:39 +02:00
scsi_dh.c
scsi_error.c scsi: core: Fix a race between scsi_done() and scsi_timeout() 2023-01-14 10:15:46 +01:00
scsi_ioctl.c
scsi_lib_dma.c
scsi_lib.c scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed 2023-06-09 10:30:12 +02:00
scsi_logging.c
scsi_logging.h
scsi_netlink.c
scsi_pm.c scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() 2022-01-27 10:54:08 +01:00
scsi_priv.h
scsi_proc.c scsi: core: Fix legacy /proc parsing buffer overflow 2023-08-16 18:21:03 +02:00
scsi_sas_internal.h
scsi_scan.c scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" 2023-02-15 17:22:11 +01:00
scsi_sysctl.c
scsi_sysfs.c scsi: core: Restrict legal sdev_state transitions via sysfs 2022-11-10 18:14:22 +01:00
scsi_trace.c
scsi_transport_api.h
scsi_transport_fc.c
scsi_transport_iscsi.c scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() 2023-09-19 12:20:17 +02:00
scsi_transport_sas.c scsi: scsi_transport_sas: Fix error handling in sas_phy_add() 2022-12-02 17:39:56 +01:00
scsi_transport_spi.c scsi: scsi_transport_spi: Set RQF_PM for domain validation commands 2021-01-12 20:18:15 +01:00
scsi_transport_srp.c scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state 2021-04-21 13:00:52 +02:00
scsi.c scsi: core: Improve scsi_vpd_inquiry() checks 2023-04-26 11:27:37 +02:00
scsi.h
scsicam.c
sd_dif.c
sd_zbc.c scsi: sd_zbc: Ensure buffer size is aligned to SECTOR_SIZE 2021-09-30 10:11:01 +02:00
sd.c scsi: sd: Revert "scsi: sd: Remove a local variable" 2022-11-03 23:57:54 +09:00
sd.h SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
sense_codes.h
ses.c scsi: ses: Handle enclosure with just a primary component gracefully 2023-04-20 12:10:27 +02:00
sg.c scsi: sg: Allow waiting for commands to complete on removed device 2022-08-21 15:15:24 +02:00
sgiwd93.c
sim710.c
sni_53c710.c scsi: sni_53c710: Add IRQ check 2021-05-14 09:50:27 +02:00
sr_ioctl.c
sr_vendor.c scsi: sr: Don't use GFP_DMA 2022-01-27 10:54:23 +01:00
sr.c scsi: sr: Don't use GFP_DMA 2022-01-27 10:54:23 +01:00
sr.h
st_options.h
st.c scsi: st: Fix a use after free in st_open() 2021-04-07 15:00:05 +02:00
st.h
stex.c scsi: stex: Fix gcc 13 warnings 2023-06-09 10:30:14 +02:00
storvsc_drv.c scsi: storvsc: Always set no_report_opcodes 2023-09-19 12:20:06 +02:00
sun3_scsi_vme.c
sun3_scsi.c
sun3x_esp.c scsi: sun3x_esp: Add IRQ check 2021-05-14 09:50:27 +02:00
sun_esp.c
virtio_scsi.c scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" 2021-10-17 10:43:33 +02:00
vmw_pvscsi.c scsi: vmw_pvscsi: Set residual data length conditionally 2022-01-05 12:40:33 +01:00
vmw_pvscsi.h scsi: vmw_pvscsi: Expand vcpuHint to 16 bits 2022-06-22 14:13:14 +02:00
wd33c93.c
wd33c93.h
wd719x.c
wd719x.h
xen-scsifront.c xen/scsifront: don't use gnttab_query_foreign_access() for mapped status 2022-03-11 12:11:54 +01:00
zalon.c
zorro7xx.c scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() 2022-04-13 21:01:04 +02:00
zorro_esp.c