From: Jon Derrick <jonathan.derrick@intel.com> Cc: Jon Derrick <jonathan.derrick@intel.com>, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, Scott Bauer <scott.bauer@intel.com>, Rafael Antognolli <rafael.antognolli@intel.com>, Jens Axboe <axboe@kernel.dk>, Christoph Hellwig <hch@lst.de>, Greg Kroah-Hartman <gregkh@linuxfoundation.org> Subject: [PATCHv3 3/4] block/sed: Check received header lengths Date: Wed, 15 Feb 2017 12:42:08 -0700 [thread overview] Message-ID: <1487187731-10293-4-git-send-email-jonathan.derrick@intel.com> (raw) In-Reply-To: <1487187731-10293-1-git-send-email-jonathan.derrick@intel.com> Add a buffer size check against discovery and response header lengths before we loop over their buffers. Signed-off-by: Jon Derrick <jonathan.derrick@intel.com> --- block/sed-opal.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/block/sed-opal.c b/block/sed-opal.c index d6dd604..feba34b 100644 --- a/block/sed-opal.c +++ b/block/sed-opal.c @@ -340,10 +340,17 @@ static int opal_discovery0_end(struct opal_dev *dev) const struct d0_header *hdr = (struct d0_header *)dev->resp; const u8 *epos = dev->resp, *cpos = dev->resp; u16 comid = 0; + u32 hlen = be32_to_cpu(hdr->length); - print_buffer(dev->resp, be32_to_cpu(hdr->length)); + print_buffer(dev->resp, hlen); - epos += be32_to_cpu(hdr->length); /* end of buffer */ + if (hlen > IO_BUFFER_LENGTH - sizeof(*hdr)) { + pr_warn("Discovery length overflows buffer (%zu+%u)/%u\n", + sizeof(*hdr), hlen, IO_BUFFER_LENGTH); + return -EFAULT; + } + + epos += hlen; /* end of buffer */ cpos += sizeof(*hdr); /* current position on buffer */ while (cpos < epos && supported) { @@ -713,6 +720,7 @@ static int response_parse(const u8 *buf, size_t length, int total; ssize_t token_length; const u8 *pos; + u32 clen, plen, slen; if (!buf) return -EFAULT; @@ -724,17 +732,16 @@ static int response_parse(const u8 *buf, size_t length, pos = buf; pos += sizeof(*hdr); - pr_debug("Response size: cp: %d, pkt: %d, subpkt: %d\n", - be32_to_cpu(hdr->cp.length), - be32_to_cpu(hdr->pkt.length), - be32_to_cpu(hdr->subpkt.length)); - - if (hdr->cp.length == 0 || hdr->pkt.length == 0 || - hdr->subpkt.length == 0) { - pr_err("Bad header length. cp: %d, pkt: %d, subpkt: %d\n", - be32_to_cpu(hdr->cp.length), - be32_to_cpu(hdr->pkt.length), - be32_to_cpu(hdr->subpkt.length)); + clen = be32_to_cpu(hdr->cp.length); + plen = be32_to_cpu(hdr->pkt.length); + slen = be32_to_cpu(hdr->subpkt.length); + pr_debug("Response size: cp: %u, pkt: %u, subpkt: %u\n", + clen, plen, slen); + + if (clen == 0 || plen == 0 || slen == 0 || + slen > IO_BUFFER_LENGTH - sizeof(*hdr)) { + pr_err("Bad header length. cp: %u, pkt: %u, subpkt: %u\n", + clen, plen, slen); print_buffer(pos, sizeof(*hdr)); return -EINVAL; } @@ -743,7 +750,7 @@ static int response_parse(const u8 *buf, size_t length, return -EFAULT; iter = resp->toks; - total = be32_to_cpu(hdr->subpkt.length); + total = slen; print_buffer(pos, total); while (total > 0) { if (pos[0] <= TINY_ATOM_BYTE) /* tiny atom */ -- 1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: Jon Derrick <jonathan.derrick@intel.com> To: unlisted-recipients:; (no To-header on input) Cc: Jon Derrick <jonathan.derrick@intel.com>, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, Scott Bauer <scott.bauer@intel.com>, Rafael Antognolli <rafael.antognolli@intel.com>, Jens Axboe <axboe@kernel.dk>, Christoph Hellwig <hch@lst.de>, Greg Kroah-Hartman <gregkh@linuxfoundation.org> Subject: [PATCHv3 3/4] block/sed: Check received header lengths Date: Wed, 15 Feb 2017 12:42:08 -0700 [thread overview] Message-ID: <1487187731-10293-4-git-send-email-jonathan.derrick@intel.com> (raw) In-Reply-To: <1487187731-10293-1-git-send-email-jonathan.derrick@intel.com> Add a buffer size check against discovery and response header lengths before we loop over their buffers. Signed-off-by: Jon Derrick <jonathan.derrick@intel.com> --- block/sed-opal.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/block/sed-opal.c b/block/sed-opal.c index d6dd604..feba34b 100644 --- a/block/sed-opal.c +++ b/block/sed-opal.c @@ -340,10 +340,17 @@ static int opal_discovery0_end(struct opal_dev *dev) const struct d0_header *hdr = (struct d0_header *)dev->resp; const u8 *epos = dev->resp, *cpos = dev->resp; u16 comid = 0; + u32 hlen = be32_to_cpu(hdr->length); - print_buffer(dev->resp, be32_to_cpu(hdr->length)); + print_buffer(dev->resp, hlen); - epos += be32_to_cpu(hdr->length); /* end of buffer */ + if (hlen > IO_BUFFER_LENGTH - sizeof(*hdr)) { + pr_warn("Discovery length overflows buffer (%zu+%u)/%u\n", + sizeof(*hdr), hlen, IO_BUFFER_LENGTH); + return -EFAULT; + } + + epos += hlen; /* end of buffer */ cpos += sizeof(*hdr); /* current position on buffer */ while (cpos < epos && supported) { @@ -713,6 +720,7 @@ static int response_parse(const u8 *buf, size_t length, int total; ssize_t token_length; const u8 *pos; + u32 clen, plen, slen; if (!buf) return -EFAULT; @@ -724,17 +732,16 @@ static int response_parse(const u8 *buf, size_t length, pos = buf; pos += sizeof(*hdr); - pr_debug("Response size: cp: %d, pkt: %d, subpkt: %d\n", - be32_to_cpu(hdr->cp.length), - be32_to_cpu(hdr->pkt.length), - be32_to_cpu(hdr->subpkt.length)); - - if (hdr->cp.length == 0 || hdr->pkt.length == 0 || - hdr->subpkt.length == 0) { - pr_err("Bad header length. cp: %d, pkt: %d, subpkt: %d\n", - be32_to_cpu(hdr->cp.length), - be32_to_cpu(hdr->pkt.length), - be32_to_cpu(hdr->subpkt.length)); + clen = be32_to_cpu(hdr->cp.length); + plen = be32_to_cpu(hdr->pkt.length); + slen = be32_to_cpu(hdr->subpkt.length); + pr_debug("Response size: cp: %u, pkt: %u, subpkt: %u\n", + clen, plen, slen); + + if (clen == 0 || plen == 0 || slen == 0 || + slen > IO_BUFFER_LENGTH - sizeof(*hdr)) { + pr_err("Bad header length. cp: %u, pkt: %u, subpkt: %u\n", + clen, plen, slen); print_buffer(pos, sizeof(*hdr)); return -EINVAL; } @@ -743,7 +750,7 @@ static int response_parse(const u8 *buf, size_t length, return -EFAULT; iter = resp->toks; - total = be32_to_cpu(hdr->subpkt.length); + total = slen; print_buffer(pos, total); while (total > 0) { if (pos[0] <= TINY_ATOM_BYTE) /* tiny atom */ -- 1.8.3.1
next prev parent reply other threads:[~2017-02-15 19:42 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-02-15 19:42 [PATCHv3 0/4] OPAL patches Jon Derrick 2017-02-15 19:42 ` Jon Derrick 2017-02-15 19:42 ` [PATCHv3 1/4] block/sed: Use ssize_t on atom parsers to return errors Jon Derrick 2017-02-15 19:42 ` Jon Derrick 2017-02-15 21:04 ` Scott Bauer 2017-02-15 19:42 ` [PATCHv3 2/4] block/sed: Add helper to qualify response tokens Jon Derrick 2017-02-15 19:42 ` Jon Derrick 2017-02-15 21:19 ` Scott Bauer 2017-02-15 19:42 ` Jon Derrick [this message] 2017-02-15 19:42 ` [PATCHv3 3/4] block/sed: Check received header lengths Jon Derrick 2017-02-15 21:09 ` Scott Bauer 2017-02-15 19:42 ` [PATCHv3 4/4] MAINTAINERS: Remove powerpc's opal match Jon Derrick 2017-02-15 19:42 ` Jon Derrick 2017-02-16 0:37 ` Stewart Smith 2017-02-16 1:00 ` Andrew Donnellan 2017-02-19 11:33 ` [PATCHv3,4/4] " Michael Ellerman 2017-02-16 5:23 ` [PATCHv3 4/4] " Michael Ellerman 2017-02-16 16:14 ` Jon Derrick 2017-02-17 16:40 ` Elliott, Robert (Persistent Memory) 2017-02-17 16:40 ` Elliott, Robert (Persistent Memory) 2017-02-21 18:44 [PATCHv3 0/4] OPAL patches cont'd Jon Derrick 2017-02-21 18:44 ` [PATCHv3 3/4] block/sed: Check received header lengths Jon Derrick 2017-02-21 18:44 ` Jon Derrick
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1487187731-10293-4-git-send-email-jonathan.derrick@intel.com \ --to=jonathan.derrick@intel.com \ --cc=axboe@kernel.dk \ --cc=gregkh@linuxfoundation.org \ --cc=hch@lst.de \ --cc=linux-block@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linuxppc-dev@lists.ozlabs.org \ --cc=rafael.antognolli@intel.com \ --cc=scott.bauer@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.