[PATCH] block: sed-opal: reject invalid method status tokens

[PATCH] block: sed-opal: reject invalid method status tokens

[Avi Weiss]

response_status() uses response_get_u64() to read the method
status. The helper returns zero for an invalid type or unsupported
atom width, so malformed responses can be reported as successful.
Values such as 256 also become zero when truncated to u8.

Validate the status token before returning its value. Report
DTAERROR_NO_METHOD_STATUS for invalid tokens while preserving valid
status values and the end-session special case.

Fixes: 455a7b238cd6 ("block: Add Sed-opal library")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 block/sed-opal.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/block/sed-opal.c b/block/sed-opal.c
index 79b290d9458a9..1eb68ce33647b 100644
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -1167,7 +1167,14 @@ static u8 response_status(const struct parsed_resp *resp)
 	if (!response_token_matches(tok, OPAL_ENDLIST))
 		return DTAERROR_NO_METHOD_STATUS;
 
-	return response_get_u64(resp, resp->num - 4);
+	tok = response_get_token(resp, resp->num - 4);
+	if (IS_ERR(tok) || tok->type != OPAL_DTA_TOKENID_UINT ||
+	    (tok->width != OPAL_WIDTH_TINY &&
+	     tok->width != OPAL_WIDTH_SHORT) ||
+	    tok->stored.u > U8_MAX)
+		return DTAERROR_NO_METHOD_STATUS;
+
+	return tok->stored.u;
 }
 
 /* Parses and checks for errors */

base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
-- 
2.43.0