linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
	Jeffrin Jose T <jeffrin@rajagiritech.edu.in>,
	Nick Desaulniers <ndesaulniers@google.com>,
	Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org>,
	linux-ide@vger.kernel.org
Subject: [PATCH AUTOSEL 5.2 20/59] libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
Date: Tue,  6 Aug 2019 17:32:40 -0400	[thread overview]
Message-ID: <20190806213319.19203-20-sashal@kernel.org> (raw)
In-Reply-To: <20190806213319.19203-1-sashal@kernel.org>

From: Kees Cook <keescook@chromium.org>

[ Upstream commit 71d6c505b4d9e6f76586350450e785e3d452b346 ]

Jeffrin reported a KASAN issue:

  BUG: KASAN: global-out-of-bounds in ata_exec_internal_sg+0x50f/0xc70
  Read of size 16 at addr ffffffff91f41f80 by task scsi_eh_1/149
  ...
  The buggy address belongs to the variable:
    cdb.48319+0x0/0x40

Much like commit 18c9a99bce2a ("libata: zpodd: small read overflow in
eject_tray()"), this fixes a cdb[] buffer length, this time in
zpodd_get_mech_type():

We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be
ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes.

Reported-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
Fixes: afe759511808c ("libata: identify and init ZPODD devices")
Link: https://lore.kernel.org/lkml/201907181423.E808958@keescook/
Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-zpodd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index 173e6f2dd9af0..eefda51f97d35 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -56,7 +56,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
 	unsigned int ret;
 	struct rm_feature_desc *desc;
 	struct ata_taskfile tf;
-	static const char cdb[] = {  GPCMD_GET_CONFIGURATION,
+	static const char cdb[ATAPI_CDB_LEN] = {  GPCMD_GET_CONFIGURATION,
 			2,      /* only 1 feature descriptor requested */
 			0, 3,   /* 3, removable medium feature */
 			0, 0, 0,/* reserved */
-- 
2.20.1


  parent reply	other threads:[~2019-08-06 21:45 UTC|newest]

Thread overview: 67+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-06 21:32 [PATCH AUTOSEL 5.2 01/59] RDMA/hns: Fix sg offset non-zero issue Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 02/59] IB/mlx5: Replace kfree with kvfree Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 03/59] clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1 Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 04/59] clk: sprd: Select REGMAP_MMIO to avoid compile errors Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 05/59] clk: renesas: cpg-mssr: Fix reset control race condition Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 06/59] dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable} Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 07/59] xtensa: fix build for cores with coprocessors Sasha Levin
2019-08-06 21:55   ` Max Filippov
2019-08-18  1:45     ` Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 08/59] platform/x86: pcengines-apuv2: Fix softdep statement Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 09/59] platform/x86: intel_pmc_core: Add ICL-NNPI support to PMC Core Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 10/59] mm/hmm: always return EBUSY for invalid ranges in hmm_range_{fault,snapshot} Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 11/59] xen/pciback: remove set but not used variable 'old_state' Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 12/59] irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 13/59] irqchip/irq-imx-gpcv2: Forward irq type to parent Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 14/59] f2fs: fix to read source block before invalidating it Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 15/59] tools perf beauty: Fix usbdevfs_ioctl table generator to handle _IOC() Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 16/59] perf header: Fix divide by zero error if f_header.attr_size==0 Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 17/59] perf header: Fix use of unitialized value warning Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 18/59] RDMA/qedr: Fix the hca_type and hca_rev returned in device attributes Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 19/59] ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain Sasha Levin
2019-08-06 21:32 ` Sasha Levin [this message]
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 21/59] powerpc/nvdimm: Pick nearby online node if the device node is not online Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 22/59] drm/bridge: lvds-encoder: Fix build error while CONFIG_DRM_KMS_HELPER=m Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 23/59] drm/bridge: tc358764: Fix build error Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 24/59] Btrfs: fix deadlock between fiemap and transaction commits Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 25/59] scsi: hpsa: correct scsi command status issue after reset Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 26/59] scsi: qla2xxx: Fix possible fcport null-pointer dereferences Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 27/59] exit: make setting exit_state consistent Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 28/59] tracing: Fix header include guards in trace event headers Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 29/59] drm/amdkfd: Fix byte align on VegaM Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 30/59] drm/amd/powerplay: fix null pointer dereference around dpm state relates Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 31/59] drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 32/59] drm/amdgpu: fix a potential information leaking bug Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 33/59] ata: libahci: do not complain in case of deferred probe Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 34/59] kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 35/59] kbuild: Check for unknown options with cc-option usage in Kconfig and clang Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 36/59] arm64/efi: fix variable 'si' set but not used Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 37/59] drm/vgem: fix cache synchronization on arm/arm64 Sasha Levin
2019-08-06 22:45   ` Rob Clark
2019-08-18  1:45     ` Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 38/59] riscv: Fix perf record without libelf support Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 39/59] i2c: iproc: Fix i2c master read more than 63 bytes Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 40/59] arm64: Lower priority mask for GIC_PRIO_IRQON Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 41/59] arm64: unwind: Prohibit probing on return_address() Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 42/59] arm64/mm: fix variable 'pud' set but not used Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 43/59] arm64/mm: fix variable 'tag' " Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 44/59] IB/core: Add mitigation for Spectre V1 Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 45/59] IB/mlx5: Fix MR registration flow to use UMR properly Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 46/59] RDMA/restrack: Track driver QP types in resource tracker Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 47/59] IB/mad: Fix use-after-free in ib mad completion handling Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 48/59] RDMA/mlx5: Release locks during notifier unregister Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 49/59] drm: msm: Fix add_gpu_components Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 50/59] RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp() Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 51/59] drm/exynos: fix missing decrement of retry counter Sasha Levin
2019-08-07  8:49   ` David Laight
2019-08-18  1:47     ` Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 52/59] arm64: kprobes: Recover pstate.D in single-step exception handler Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 53/59] arm64: Make debug exception handlers visible from RCU Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 54/59] Revert "kmemleak: allow to coexist with fault injection" Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 55/59] ocfs2: remove set but not used variable 'last_hash' Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 56/59] page flags: prioritize kasan bits over last-cpuid Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 57/59] coredump: split pipe command whitespace before expanding template Sasha Levin
2019-08-07  1:41   ` Paul Wise
2019-08-18  1:48     ` Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 58/59] asm-generic: fix -Wtype-limits compiler warnings Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 59/59] tpm: tpm_ibm_vtpm: Fix unallocated banks Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190806213319.19203-20-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=axboe@kernel.dk \
    --cc=jeffrin@rajagiritech.edu.in \
    --cc=keescook@chromium.org \
    --cc=linux-ide@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ndesaulniers@google.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).