From: Tomas Henzl <thenzl@redhat.com>
To: linux-scsi@vger.kernel.org
Subject: [PATCH 3/4] ses: fix possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process
Date: Mon, 30 Jan 2023 11:13:16 +0100 [thread overview]
Message-ID: <20230130101317.4862-4-thenzl@redhat.com> (raw)
In-Reply-To: <20230130101317.4862-1-thenzl@redhat.com>
Sanitize possible desc_ptr out-of-bounds accesses
in ses_enclosure_data_process.
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
---
drivers/scsi/ses.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 896fd4f6e93d..dbfe12f63c98 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -572,15 +572,19 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
int max_desc_len;
if (desc_ptr) {
- if (desc_ptr >= buf + page7_len) {
+ if (desc_ptr + 3 >= buf + page7_len) {
desc_ptr = NULL;
} else {
len = (desc_ptr[2] << 8) + desc_ptr[3];
desc_ptr += 4;
- /* Add trailing zero - pushes into
- * reserved space */
- desc_ptr[len] = '\0';
- name = desc_ptr;
+ if (desc_ptr + len > buf + page7_len)
+ desc_ptr = NULL;
+ else {
+ /* Add trailing zero - pushes into
+ * reserved space */
+ desc_ptr[len] = '\0';
+ name = desc_ptr;
+ }
}
}
if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
--
2.38.1
next prev parent reply other threads:[~2023-01-30 10:14 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-30 10:13 [PATCH 0/4] ses: prevent from out of bounds accesses Tomas Henzl
2023-01-30 10:13 ` [PATCH 1/4] ses: fix slab-out-of-bounds reported by KASAN in ses_enclosure_data_process Tomas Henzl
2023-01-30 10:13 ` [PATCH 2/4] ses: fix possible addl_desc_ptr out-of-bounds accesses " Tomas Henzl
2023-01-30 10:13 ` Tomas Henzl [this message]
2023-01-30 10:13 ` [PATCH 4/4] ses: fix slab-out-of-bounds reported by KASAN in ses_intf_remove Tomas Henzl
2023-01-30 10:28 ` [PATCH 0/4] ses: prevent from out of bounds accesses Miko Larsson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230130101317.4862-4-thenzl@redhat.com \
--to=thenzl@redhat.com \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.