From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BAB4C433DB for ; Thu, 31 Dec 2020 00:16:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DE21E207AF for ; Thu, 31 Dec 2020 00:16:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726573AbgLaAQj (ORCPT ); Wed, 30 Dec 2020 19:16:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58606 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726492AbgLaAQi (ORCPT ); Wed, 30 Dec 2020 19:16:38 -0500 Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CC72C061799 for ; Wed, 30 Dec 2020 16:15:58 -0800 (PST) Received: by mail-pg1-x530.google.com with SMTP id c22so12178504pgg.13 for ; Wed, 30 Dec 2020 16:15:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxace-com.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=au5deversDUhjJZ37Ftd3WtVvchDXjoeRWjmb+KgOHU=; b=MhWOQFZsHAE0uuFnYbB/Jc8/42rNUcbi/V4UxJV83oD22AQ+STPyLsxxBUt9LSBWuM FiiC6HSt0I3g688dwrqFrS9xKAS1mKVlI6cgloEQg4yCBCQLm6ui3hqiLfXYOZDQjN/c yTGw1jWAMEKEVCQNRT0ZsV4ES9Gxz2o6MX03p4k0xdRw88kqJLS5RVQuaVrp2cUQjavc IqcpA3rfmXAVgK2akbcJ+3xDoJPULOv/4EtSlbJ9NkqCFgPO1OACDhkN+azVbi3QkVw+ 1EJUqE//dWefJfE996DoJfPls6PQUy2Ym3Ic6dSPDorr/9f/pG5KIBhHH2x75WAtLWyo ttEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=au5deversDUhjJZ37Ftd3WtVvchDXjoeRWjmb+KgOHU=; b=Z6+tFYVmyIgS23LPg6CqQG8sbjdIMBZlj503ajGKr+8nSBBEz8QBRekB2+2x4uNeRl ZBnLmgtgQifH9GKFAAQTVrvwH64sj7tDMmhKHYuuanYCTh7QPdozgqjgJy8N7HyvIvss JHxs/mC12Qi8ilTgRr0oUsjWsf4fgm9z1VxHlPoCmQ1AWrwjazPCD+6AD1b26a06FiTE qcAZqfmtOLpFmAKKSvw5CeQUFxAVSR6oSCj1rDWfKaGSM/i6kVLmWilVoeJdv85QmBJU /HwyfcQl92LQbU4oIidaCEKHPq4UNpkTKLrifUVAmYX+Vcpsls4J24KgkQCqslMScmLx jAbg== X-Gm-Message-State: AOAM5324aREgCpr0vSUTakVJwJ5kYg3Tv+oGUdpdxSDncUVcmW1xBsTC 5llCle/dot1GUHkEgfUq8q5dvQ== X-Google-Smtp-Source: ABdhPJwcB47Au0SCL2bya0Ek9wpMqDiNDQIFM8LUop6tXifOpwCBlrKfIqN2Er69MYwJ7KdsZOMWEw== X-Received: by 2002:a63:da50:: with SMTP id l16mr38832354pgj.447.1609373757086; Wed, 30 Dec 2020 16:15:57 -0800 (PST) Received: from home.linuxace.com (cpe-23-243-7-246.socal.res.rr.com. [23.243.7.246]) by smtp.gmail.com with ESMTPSA id h18sm44326353pfo.172.2020.12.30.16.15.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 30 Dec 2020 16:15:56 -0800 (PST) Date: Wed, 30 Dec 2020 16:15:53 -0800 From: Phil Oester To: Arnd Bergmann Cc: Kashyap Desai , Sumit Saxena , Shivasharan S , "James E.J. Bottomley" , "Martin K. Petersen" , hch@infradead.org, Arnd Bergmann , stable@vger.kernel.org, Anand Lodnoor , Chandrakanth Patil , Hannes Reinecke , megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 2/3] scsi: megaraid_sas: check user-provided offsets Message-ID: <20201231001553.GB16945@home.linuxace.com> References: <20200908213715.3553098-1-arnd@arndb.de> <20200908213715.3553098-2-arnd@arndb.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200908213715.3553098-2-arnd@arndb.de> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Sep 08, 2020 at 11:36:22PM +0200, Arnd Bergmann wrote: > It sounds unwise to let user space pass an unchecked 32-bit > offset into a kernel structure in an ioctl. This is an unsigned > variable, so checking the upper bound for the size of the structure > it points into is sufficient to avoid data corruption, but as > the pointer might also be unaligned, it has to be written carefully > as well. > > While I stumbled over this problem by reading the code, I did not > continue checking the function for further problems like it. Sorry for replying to an ancient thread, but this patch just recently made it into 5.10.3 and has caused unintended consequences. On Dell servers with PERC RAID controllers, booting 5.10.3+ with this patch causes a PCI parity error. Specifically: Event Message: A PCI parity error was detected on a component at bus 0 device 5 function 0. Severity: Critical Message ID: PCI1308 I reverted this single patch and the errors went away. Thoughts? Phil Oester