From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ye Bin <yebin10@huawei.com>,
Douglas Gilbert <dgilbert@interlog.com>,
"Martin K . Petersen" <martin.petersen@oracle.com>,
Sasha Levin <sashal@kernel.org>,
JBottomley@odin.com, linux-scsi@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 62/82] scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
Date: Tue, 9 Nov 2021 17:16:20 -0500 [thread overview]
Message-ID: <20211109221641.1233217-62-sashal@kernel.org> (raw)
In-Reply-To: <20211109221641.1233217-1-sashal@kernel.org>
From: Ye Bin <yebin10@huawei.com>
[ Upstream commit 4e3ace0051e7e504b55d239daab8789dd89b863c ]
The following warning was observed running syzkaller:
[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;
[ 3813.830724] program syz-executor not setting count and/or reply_len properly
[ 3813.836956] ==================================================================
[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0
[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549
[ 3813.846612] Call Trace:
[ 3813.846995] dump_stack+0x108/0x15f
[ 3813.847524] print_address_description+0xa5/0x372
[ 3813.848243] kasan_report.cold+0x236/0x2a8
[ 3813.849439] check_memory_region+0x240/0x270
[ 3813.850094] memcpy+0x30/0x80
[ 3813.850553] sg_copy_buffer+0x157/0x1e0
[ 3813.853032] sg_copy_from_buffer+0x13/0x20
[ 3813.853660] fill_from_dev_buffer+0x135/0x370
[ 3813.854329] resp_readcap16+0x1ac/0x280
[ 3813.856917] schedule_resp+0x41f/0x1630
[ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0
[ 3813.862699] scsi_dispatch_cmd+0x330/0x950
[ 3813.863329] scsi_request_fn+0xd8e/0x1710
[ 3813.863946] __blk_run_queue+0x10b/0x230
[ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400
[ 3813.865220] sg_common_write.isra.0+0xe61/0x2420
[ 3813.871637] sg_write+0x6c8/0xef0
[ 3813.878853] __vfs_write+0xe4/0x800
[ 3813.883487] vfs_write+0x17b/0x530
[ 3813.884008] ksys_write+0x103/0x270
[ 3813.886268] __x64_sys_write+0x77/0xc0
[ 3813.886841] do_syscall_64+0x106/0x360
[ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9
This issue can be reproduced with the following syzkaller log:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00')
open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)
r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782)
write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126)
In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass
the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This
leads to OOB in sg_copy_buffer().
To solve this issue, define alloc_len as u32.
Link: https://lore.kernel.org/r/20211013033913.2551004-2-yebin10@huawei.com
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 66f507469a31a..be04405457447 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1856,7 +1856,7 @@ static int resp_readcap16(struct scsi_cmnd *scp,
{
unsigned char *cmd = scp->cmnd;
unsigned char arr[SDEBUG_READCAP16_ARR_SZ];
- int alloc_len;
+ u32 alloc_len;
alloc_len = get_unaligned_be32(cmd + 10);
/* following just in case virtual_gb changed */
@@ -1885,7 +1885,7 @@ static int resp_readcap16(struct scsi_cmnd *scp,
}
return fill_from_dev_buffer(scp, arr,
- min_t(int, alloc_len, SDEBUG_READCAP16_ARR_SZ));
+ min_t(u32, alloc_len, SDEBUG_READCAP16_ARR_SZ));
}
#define SDEBUG_MAX_TGTPGS_ARR_SZ 1412
--
2.33.0
next prev parent reply other threads:[~2021-11-09 22:21 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-09 22:15 [PATCH AUTOSEL 5.15 01/82] arm64: zynqmp: Do not duplicate flash partition label property Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 02/82] arm64: zynqmp: Fix serial compatible string Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 03/82] clk: sunxi-ng: Unregister clocks/resets when unbinding Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 04/82] ARM: dts: sunxi: Fix OPPs node name Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 05/82] arm64: dts: allwinner: h5: Fix GPU thermal zone " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 06/82] arm64: dts: allwinner: a100: Fix " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 07/82] staging: wfx: ensure IRQ is ready before enabling it Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 08/82] ARM: dts: BCM5301X: Fix nodes names Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 09/82] ARM: dts: BCM5301X: Fix MDIO mux binding Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 10/82] ARM: dts: NSP: Fix mpcore, mmc node names Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 11/82] arm64: dts: broadcom: bcm4908: Move reboot syscon out of bus Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 12/82] scsi: pm80xx: Fix memory leak during rmmod Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 13/82] scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 14/82] ASoC: mediatek: mt8195: Add missing of_node_put() Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 15/82] arm64: dts: rockchip: Disable CDN DP on Pinebook Pro Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 16/82] arm64: dts: hisilicon: fix arm,sp805 compatible string Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 17/82] arm64: dts: rockchip: add Coresight debug range for RK3399 Sasha Levin
2021-11-09 23:25 ` Brian Norris
2021-11-10 0:44 ` Sasha Levin
2021-11-10 0:49 ` Brian Norris
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 18/82] RDMA/bnxt_re: Check if the vlan is valid before reporting Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 19/82] bus: ti-sysc: Add quirk handling for reinit on context lost Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 20/82] bus: ti-sysc: Use context lost quirk for otg Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 21/82] usb: musb: tusb6010: check return value after calling platform_get_resource() Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 22/82] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 23/82] ARM: dts: ux500: Skomer regulator fixes Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 24/82] staging: rtl8723bs: remove possible deadlock when disconnect (v2) Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 25/82] staging: rtl8723bs: remove a second possible deadlock Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 26/82] staging: rtl8723bs: remove a third " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 27/82] ARM: BCM53016: Specify switch ports for Meraki MR32 Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 28/82] arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 29/82] arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 30/82] arm64: dts: qcom: ipq8074: " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 31/82] arm64: dts: qcom: sdm845: " Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 32/82] arm64: dts: qcom: msm8916: Add unit name for /soc node Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 33/82] arm64: dts: freescale: fix arm,sp805 compatible string Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 34/82] arm64: dts: ls1012a: Add serial alias for ls1012a-rdb Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 35/82] RDMA/rxe: Separate HW and SW l/rkeys Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 36/82] ASoC: SOF: Intel: hda-dai: fix potential locking issue Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 37/82] scsi: core: Fix scsi_mode_sense() buffer length handling Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 38/82] ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and UFX1604 Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 39/82] clk: imx: imx6ul: Move csi_sel mux to correct base register Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 40/82] ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ Sasha Levin
2021-11-09 22:15 ` [PATCH AUTOSEL 5.15 41/82] ASoC: rt5651: " Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 42/82] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 43/82] scsi: advansys: Fix kernel pointer leak Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 44/82] scsi: smartpqi: Add controller handshake during kdump Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 45/82] arm64: dts: imx8mm-kontron: Fix reset delays for ethernet PHY Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 46/82] ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 47/82] ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 48/82] ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45 Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 49/82] firmware_loader: fix pre-allocated buf built-in firmware use Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 50/82] cpuidle: tegra: Check whether PMC is ready Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 51/82] HID: multitouch: disable sticky fingers for UPERFECT Y Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 52/82] ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 53/82] ARM: dts: omap: fix gpmc,mux-add-data type Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 54/82] usb: host: ohci-tmio: check return value after calling platform_get_resource() Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 55/82] ASoC: rt5682: fix a little pop while playback Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 56/82] ARM: dts: ls1021a: move thermal-zones node out of soc/ Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 57/82] ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 58/82] ALSA: ISA: not for M68K Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 59/82] iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel option Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 60/82] tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 61/82] MIPS: sni: Fix the build Sasha Levin
2021-11-09 22:16 ` Sasha Levin [this message]
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 63/82] scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 64/82] scsi: target: Fix ordered tag handling Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 65/82] scsi: target: Fix alua_tg_pt_gps_count tracking Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 66/82] iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() Sasha Levin
2021-11-12 17:33 ` Jonathan Cameron
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 67/82] RDMA/core: Use kvzalloc when allocating the struct ib_port Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 68/82] scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 69/82] scsi: lpfc: Fix link down processing to address NULL pointer dereference Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 70/82] scsi: lpfc: Allow fabric node recovery if recovery is in progress before devloss Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 71/82] memory: tegra20-emc: Add runtime dependency on devfreq governor module Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 72/82] powerpc/5200: dts: fix memory node unit name Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 73/82] arm64: dts: qcom: msm8916: Add CPU ACC and SAW/SPM Sasha Levin
2021-11-10 8:40 ` Stephan Gerhold
2021-11-12 13:43 ` Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 74/82] ARM: dts: qcom: fix memory and mdio nodes naming for RB3011 Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 75/82] arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 76/82] ALSA: gus: fix null pointer dereference on pointer block Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 77/82] ALSA: usb-audio: fix null pointer dereference on pointer cs_desc Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 78/82] clk: at91: sama7g5: remove prescaler part of master clock Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 79/82] iommu/dart: Initialize DART_STREAMS_ENABLE Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 80/82] powerpc/dcr: Use cmplwi instead of 3-argument cmpli Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 81/82] powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST Sasha Levin
2021-11-09 22:16 ` [PATCH AUTOSEL 5.15 82/82] HID: playstation: require multicolor LED functionality Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211109221641.1233217-62-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=JBottomley@odin.com \
--cc=dgilbert@interlog.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=stable@vger.kernel.org \
--cc=yebin10@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox