Re: [PATCH 1/4] scsi: sd: reject invalid pr_read_keys() num_keys values

Hannes Reinecke
2025-11-27T06:59:41Z

On 11/26/25 17:35, Stefan Hajnoczi wrote:
> The pr_read_keys() interface has a u32 num_keys parameter. The SCSI
> PERSISTENT RESERVE IN command has a maximum READ KEYS service action
> size of 65536 bytes. Reject num_keys values that are too large to fit
> into the SCSI command.
>
> This will become important when pr_read_keys() is exposed to untrusted
> userspace via an <linux/pr.h> ioctl.
>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
> drivers/scsi/sd.c | 11 ++++++++++-
> 1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index 0252d3f6bed17..d65646f35f453 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -1974,9 +1974,18 @@ static int sd_pr_read_keys(struct block_device *bdev, struct pr_keys *keys_info)
> {
> int result, i, data_offset, num_copy_keys;
> u32 num_keys = keys_info->num_keys;
> - int data_len = num_keys * 8 + 8;
> + int data_len;
> u8 *data;
>
> + /*
> + * Each reservation key takes 8 bytes and there is an 8-byte header
> + * before the reservation key list. The total size must fit into the
> + * 16-bit ALLOCATION LENGTH field.
> + */
> + if (num_keys > (65536 - 8) / 8)

Odd coding. Maybe (USHRT_MAX / 8) - 1 ?

> + return -EINVAL;
> +
> + data_len = num_keys * 8 + 8;
> data = kzalloc(data_len, GFP_KERNEL);
> if (!data)
> return -ENOMEM;

Cheers,

Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich