From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751268AbdCPFVt (ORCPT ); Thu, 16 Mar 2017 01:21:49 -0400 Received: from szxga02-in.huawei.com ([45.249.212.188]:3889 "EHLO dggrg02-dlp.huawei.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1751169AbdCPFVs (ORCPT ); Thu, 16 Mar 2017 01:21:48 -0400 Subject: Re: [PATCH] scsi: sr: fix oob access in get_capabilities To: "Martin K. Petersen" References: <1488536272-10509-1-git-send-email-wangkefeng.wang@huawei.com> CC: Jens Axboe , "James E.J. Bottomley" , , From: Kefeng Wang Message-ID: <3f08ece0-531e-6853-d47d-a860e81e55d6@huawei.com> Date: Thu, 16 Mar 2017 13:21:01 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.177.19.180] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.58CA20C4.038A,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: a74399f5bfbc952a40a784bf1ebc9804 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2017/3/16 8:07, Martin K. Petersen wrote: > Kefeng Wang writes: > > Kefeng, > >> 'n = header_length + block_descriptor_length' could be greater than 512, >> and will lead to oob access, so enlarge transfer buffer to fix it. > > Can you share the output of sg_modes -p 0x2a /dev/srN for the offending > drive? root@localhost ~]# sg_modes -p 0x2a /dev/sr0 QEMU QEMU DVD-ROM 0.15 peripheral_type: cd/dvd [0x5] Mode parameter header from MODE SENSE(10): Invalid block descriptor length=512, ignore Mode data length=36, medium type=0x70, specific param=0x00, longlba=0 Block descriptor length=0 >> MM capabilities and mechanical status (obsolete), page_control: current 00 2a 12 00 00 71 60 29 00 02 c2 00 02 02 00 02 c2 10 00 00 00 00 Unexpectedly received extra mode page responses, ignore note: the issue was found in guestos? maybe some bugs exist in qemu? Kefeng > > This mode page is usually much smaller than 512 bytes (typically between > 32 and 128 bytes). >