From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751897AbdCCKZQ (ORCPT ); Fri, 3 Mar 2017 05:25:16 -0500 Received: from szxga03-in.huawei.com ([45.249.212.189]:3457 "EHLO dggrg03-dlp.huawei.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751408AbdCCKYq (ORCPT ); Fri, 3 Mar 2017 05:24:46 -0500 From: Kefeng Wang To: Jens Axboe , "James E.J. Bottomley" , "Martin K. Petersen" CC: , , Kefeng Wang Subject: [PATCH] scsi: sr: fix oob access in get_capabilities Date: Fri, 3 Mar 2017 18:17:52 +0800 Message-ID: <1488536272-10509-1-git-send-email-wangkefeng.wang@huawei.com> X-Mailer: git-send-email 1.7.12.4 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.102.37] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020203.58B943BE.0185,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: c445aa249079977ec46d7e17a1421097 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 'n = header_length + block_descriptor_length' could be greater than 512, and will lead to oob access, so enlarge transfer buffer to fix it. === BUG: KASAN: slab-out-of-bounds in sr_probe+0x570/0xcc0 at addr ffff88000009020e Read of size 1 by task kworker/u48:2/188 Signed-off-by: Kefeng Wang --- drivers/scsi/sr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c index 0b29b93..5a80aa6 100644 --- a/drivers/scsi/sr.c +++ b/drivers/scsi/sr.c @@ -852,7 +852,7 @@ static void get_capabilities(struct scsi_cd *cd) /* allocate transfer buffer */ - buffer = kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer = kmalloc(1024, GFP_KERNEL | GFP_DMA); if (!buffer) { sr_printk(KERN_ERR, cd, "out of memory.\n"); return; -- 1.7.12.4