From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stefan Richter Subject: [PATCH 1/2] sd: fix memory corruption by sd_read_cache_type Date: Thu, 23 Feb 2006 02:02:57 +0100 (CET) Message-ID: Mime-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=us-ascii Return-path: Received: from einhorn.in-berlin.de ([192.109.42.8]:19116 "EHLO einhorn.in-berlin.de") by vger.kernel.org with ESMTP id S1751481AbWBWBD6 (ORCPT ); Wed, 22 Feb 2006 20:03:58 -0500 Content-Disposition: INLINE Sender: linux-scsi-owner@vger.kernel.org List-Id: linux-scsi@vger.kernel.org To: stable@kernel.org, Linus Torvalds Cc: linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org, Al Viro , Jody McIntyre sd: fix memory corruption by sd_read_cache_type Let sd check more thoroughly before using mode_sense responses for data length calculation. Fixes memory corruption ("slab error in cache_free_debugcheck") or kernel panic when buggy disks are connected, notably Initio SBP-2 bridges. http://bugzilla.kernel.org/show_bug.cgi?id=6114 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182005 Taken from a patch by Al Viro . http://marc.theaimsgroup.com/?l=linux-scsi&m=114055884611429 Signed-off-by: Stefan Richter --- Patch is applicable to 2.6.14, 2.6.15, 2.6.16. Index: linux-2.6.16-rc4/drivers/scsi/sd.c =================================================================== --- linux-2.6.16-rc4.orig/drivers/scsi/sd.c 2006-02-22 22:27:42.000000000 +0100 +++ linux-2.6.16-rc4/drivers/scsi/sd.c 2006-02-22 22:29:10.000000000 +0100 @@ -1342,6 +1342,8 @@ sd_read_cache_type(struct scsi_disk *sdk /* Take headers and block descriptors into account */ len += data.header_length + data.block_descriptor_length; + if (len > 512) + goto bad_sense; /* Get the data */ res = sd_do_mode_sense(sdp, dbd, modepage, buffer, len, &data, &sshdr); @@ -1354,6 +1356,12 @@ sd_read_cache_type(struct scsi_disk *sdk int ct = 0; int offset = data.header_length + data.block_descriptor_length; + if (offset >= 512 - 2) { + printk(KERN_ERR "%s: malformed MODE SENSE response", + diskname); + goto defaults; + } + if ((buffer[offset] & 0x3f) != modepage) { printk(KERN_ERR "%s: got wrong page\n", diskname); goto defaults;