From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753019AbdHIOMO (ORCPT ); Wed, 9 Aug 2017 10:12:14 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:33655 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752931AbdHIOML (ORCPT ); Wed, 9 Aug 2017 10:12:11 -0400 From: Benjamin Block To: "James E . J . Bottomley" , "Martin K . Petersen" , Jens Axboe Cc: Benjamin Block , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org, Johannes Thumshirn , Christoph Hellwig , Steffen Maier , open-iscsi@googlegroups.com Subject: [RFC PATCH 3/6] bsg: scsi-transport: add compile-tests to prevent reply-buffer overflows Date: Wed, 9 Aug 2017 16:11:17 +0200 X-Mailer: git-send-email 2.12.2 In-Reply-To: References: In-Reply-To: References: X-TM-AS-GCONF: 00 x-cbid: 17080914-0040-0000-0000-000003EE934E X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17080914-0041-0000-0000-0000208DD190 Message-Id: <0f448e7771f438025de755530778691ff535e36c.1502120928.git.bblock@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-08-09_04:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1706020000 definitions=main-1708090220 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The BSG implementations use the bsg_job's reply buffer as storage for their own custom reply structures (e.g.: struct fc_bsg_reply or struct iscsi_bsg_reply). The size of bsg_job's reply buffer and those of the implementations is not dependent in any way the compiler can currently check. To make it easier to notice accidental violations add an explicit compile- time check that tests whether the implementations' reply buffer is at most as large as bsg_job's. To do so, we have to move the size-define from bsg.c to a common header. Signed-off-by: Benjamin Block --- block/bsg.c | 3 +-- drivers/scsi/scsi_transport_fc.c | 3 +++ drivers/scsi/scsi_transport_iscsi.c | 3 +++ include/linux/bsg-lib.h | 2 ++ 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/block/bsg.c b/block/bsg.c index 285b1b8126c3..b924f1c23c58 100644 --- a/block/bsg.c +++ b/block/bsg.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include @@ -74,8 +75,6 @@ static int bsg_major; static struct kmem_cache *bsg_cmd_cachep; -#define BSG_COMMAND_REPLY_BUFFERSIZE SCSI_SENSE_BUFFERSIZE - /* * our internal command type */ diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c index 892fbd9800d9..ce6654b5d329 100644 --- a/drivers/scsi/scsi_transport_fc.c +++ b/drivers/scsi/scsi_transport_fc.c @@ -3736,6 +3736,9 @@ static int fc_bsg_dispatch(struct bsg_job *job) { struct Scsi_Host *shost = fc_bsg_to_shost(job); + BUILD_BUG_ON(sizeof(struct fc_bsg_reply) > + BSG_COMMAND_REPLY_BUFFERSIZE); + if (scsi_is_fc_rport(job->dev)) return fc_bsg_rport_dispatch(shost, job); else diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index a424eaeafeb0..4e021c949ad7 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -1483,6 +1483,9 @@ static int iscsi_bsg_host_dispatch(struct bsg_job *job) int cmdlen = sizeof(uint32_t); /* start with length of msgcode */ int ret; + BUILD_BUG_ON(sizeof(struct iscsi_bsg_reply) > + BSG_COMMAND_REPLY_BUFFERSIZE); + /* check if we have the msgcode value at least */ if (job->request_len < sizeof(uint32_t)) { ret = -ENOMSG; diff --git a/include/linux/bsg-lib.h b/include/linux/bsg-lib.h index e34dde2da0ef..85d7c7678cc6 100644 --- a/include/linux/bsg-lib.h +++ b/include/linux/bsg-lib.h @@ -25,6 +25,8 @@ #include +#define BSG_COMMAND_REPLY_BUFFERSIZE SCSI_SENSE_BUFFERSIZE + struct request; struct device; struct scatterlist; -- 2.12.2