From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754781AbbGCJGs (ORCPT ); Fri, 3 Jul 2015 05:06:48 -0400 Received: from cantor2.suse.de ([195.135.220.15]:48059 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754673AbbGCJGe convert rfc822-to-8bit (ORCPT ); Fri, 3 Jul 2015 05:06:34 -0400 From: Johannes Thumshirn To: Dan Carpenter Cc: Nagalakshmi Nandigama , Praveen Krishnamoorthy , Sreekanth Reddy , Abhijit Mahajan , MPT-FusionLinux.pdl@avagotech.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: Re: [patch] mptfusion: prevent some memory corruption References: <20150703085303.GA11901@mwanda> Date: Fri, 03 Jul 2015 11:06:32 +0200 In-Reply-To: <20150703085303.GA11901@mwanda> (Dan Carpenter's message of "Fri, 3 Jul 2015 11:53:03 +0300") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Dan Carpenter writes: > These are signed values the come from the user, we put a cap on the > upper bounds but not on the lower bounds. > > We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and > proceed as if that means that "karg.dataSgeOffset" is correct but this > fails to consider that the "sz" calculations can have integer overflows. > > Signed-off-by: Dan Carpenter > --- > During my QC process, I realized that I sent a similar patch last year, > but never received a response. > > http://permalink.gmane.org/gmane.linux.kernel.janitors/32590 > > Looking at both of them, I guess I prefer today's patch because it is > simpler. > > diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c > index 70bb753..fc73937 100644 > --- a/drivers/message/fusion/mptctl.c > +++ b/drivers/message/fusion/mptctl.c > @@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr) > } > spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags); > > + /* Basic sanity checks to prevent underflows or integer overflows */ > + if (karg.maxReplyBytes < 0 || > + karg.dataInSize < 0 || > + karg.dataOutSize < 0 || > + karg.dataSgeOffset < 0 || > + karg.maxSenseBytes < 0 || > + karg.dataSgeOffset > ioc->req_sz / 4) > + return -EINVAL; > + > /* Verify that the final request frame will not be too large. > */ > sz = karg.dataSgeOffset * 4; > -- > To unsubscribe from this list: send the line "unsubscribe linux-scsi" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html Acked-by: Johannes Thumshirn -- Johannes Thumshirn Storage jthumshirn@suse.de +49 911 74053 689 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg GF: F. Imendörffer, J. Smithard, J. Guild, D. Upmanyu, G. Norton HRB 21284 (AG Nürnberg)