[PATCH] scsi_debug: fix sanity check in resp_rsup_opcodes

[PATCH] scsi_debug: fix sanity check in resp_rsup_opcodes

[Douglas Gilbert]

[-- Attachment #1: Type: text/plain, Size: 420 bytes --]

David Binderman pointed out in this post:

http://marc.info/?l=linux-scsi&m=141924469523474&w=2

a sanity check that was flawed. See attached fix. Should
be applied to lk 3.19.0-rc1 and Christoph's branches.

ChangeLog:
     fix alloc_len sanity check in resp_rsup_opcodes()


---
  drivers/scsi/scsi_debug.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>

[-- Attachment #2: 0001-scsi_debug-sanity-check-in-resp_rsup_opcodes.patch --]
[-- Type: text/x-patch, Size: 905 bytes --]

>From 89e7ac4920ef22943fe94112221ab3760dc3f763 Mon Sep 17 00:00:00 2001
From: Douglas Gilbert <dgilbert@interlog.com>
Date: Mon, 22 Dec 2014 10:16:55 -0500
Subject: [PATCH] scsi_debug sanity check in resp_rsup_opcodes

fix alloc_len sanity check in resp_rsup_opcodes()
---
 drivers/scsi/scsi_debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 7b8b51b..63a2e1f 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1623,7 +1623,7 @@ resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
 	req_opcode = cmd[3];
 	req_sa = get_unaligned_be16(cmd + 4);
 	alloc_len = get_unaligned_be32(cmd + 6);
-	if (alloc_len < 4 && alloc_len > 0xffff) {
+	if (alloc_len < 4 || alloc_len > 0xffff) {
 		mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
 		return check_condition_result;
 	}
-- 
1.9.1

Re: [PATCH] scsi_debug: fix sanity check in resp_rsup_opcodes

[Ewan Milne]

On Mon, 2014-12-22 at 11:37 -0500, Douglas Gilbert wrote:
> David Binderman pointed out in this post:
> 
> http://marc.info/?l=linux-scsi&m=141924469523474&w=2
> 
> a sanity check that was flawed. See attached fix. Should
> be applied to lk 3.19.0-rc1 and Christoph's branches.
> 
> ChangeLog:
>      fix alloc_len sanity check in resp_rsup_opcodes()
> 
> 
> ---
>   drivers/scsi/scsi_debug.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>

Reviewed-by: Ewan D. Milne <emilne@redhat.com>