[PATCH] st: reject MTIOCTOP mt_count values out of range for the SPACE(6) scsi command

From: Patrick Strateman <patrick.strateman@gmail.com>
To: linux-scsi@vger.kernel.org
Cc: "Kai Mäkisara" <Kai.Makisara@kolumbus.fi>
Subject: [PATCH] st: reject MTIOCTOP mt_count values out of range for the SPACE(6) scsi command
Date: Tue, 12 Jan 2021 21:24:35 -0500	[thread overview]
Message-ID: <CA+-=Uwah2MS_aD+PeSBkQa_=1wCD+3=g6W4PvLnbJ_-px8G97g@mail.gmail.com> (raw)

Values greater than 0x7FFFFF do not fit in the 24 bit big endian two's
complement integer for the underlying scsi SPACE(6) command.

Signed-off-by: Patrick Strateman <patrick.strateman@gmail.com>
---
 drivers/scsi/st.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 43f7624508a9..190fa678d149 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -2719,6 +2719,22 @@ static int st_int_ioctl(struct scsi_tape *STp,
unsigned int cmd_in, unsigned lon
     blkno = STps->drv_block;
     at_sm = STps->at_sm;

+    switch (cmd_in) {
+    case MTFSFM:
+    case MTFSF:
+    case MTBSFM:
+    case MTBSF:
+    case MTFSR:
+    case MTBSR:
+    case MTFSS:
+    case MTBSS:
+        // count field for SPACE(6) is a 24 bit big endian two's
complement integer
+        if (arg > 0x7FFFFF) {
+            st_printk(ST_DEB_MSG, STp, "Cannot space more than
0x7FFFFF units.\n");
+            return (-EINVAL);
+        }
+    }
+
     memset(cmd, 0, MAX_COMMAND_SIZE);
     switch (cmd_in) {
     case MTFSFM:
