From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756187AbdCUC35 (ORCPT ); Mon, 20 Mar 2017 22:29:57 -0400 Received: from szxga01-in.huawei.com ([45.249.212.187]:4339 "EHLO dggrg01-dlp.huawei.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1754656AbdCUC3W (ORCPT ); Mon, 20 Mar 2017 22:29:22 -0400 Subject: Re: [PATCH] scsi: sr: fix oob access in get_capabilities To: "Martin K. Petersen" References: <1488536272-10509-1-git-send-email-wangkefeng.wang@huawei.com> <3f08ece0-531e-6853-d47d-a860e81e55d6@huawei.com> <0d4c496b-c435-b622-58f8-25bd4490186a@huawei.com> CC: Jens Axboe , "James E.J. Bottomley" , , , Douglas Gilbert From: Kefeng Wang Message-ID: Date: Tue, 21 Mar 2017 10:20:25 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.177.19.180] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090205.58D08DF7.0003,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 64922926e12d7321e314987e4bd668f3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2017/3/20 22:29, Martin K. Petersen wrote: > Kefeng Wang writes: > > Kefeng, > >> The issue still exists, the patch return zero in scsi_mode_sense(), but zero means >> SAM_STAT_GOOD in scsi_status_is_good(), so n will be still bigger than 512; > > OK, I checked the other users of scsi_mode_sense(). So let's keep this > fix local to sr.c for now. > > How about the following? > > > scsi: sr: Sanity check returned mode data > > Kefeng Wang discovered that old versions of the QEMU CD driver would > return mangled mode data causing us to walk off the end of the buffer in > an attempt to parse it. Sanity check the returned mode sense data. > > Cc: > Reported-by: Kefeng Wang > Signed-off-by: Martin K. Petersen > > diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c > index 0b29b9329b1c..a8f630213a1a 100644 > --- a/drivers/scsi/sr.c > +++ b/drivers/scsi/sr.c > @@ -836,6 +836,7 @@ static void get_capabilities(struct scsi_cd *cd) > unsigned char *buffer; > struct scsi_mode_data data; > struct scsi_sense_hdr sshdr; > + unsigned int ms_len = 128; > int rc, n; > > static const char *loadmech[] = > @@ -862,10 +863,11 @@ static void get_capabilities(struct scsi_cd *cd) > scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr); > > /* ask for mode page 0x2a */ > - rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128, > + rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len, > SR_TIMEOUT, 3, &data, NULL); > move n = data.header_length + data.block_descriptor_length; here, > - if (!scsi_status_is_good(rc)) { > + if (!scsi_status_is_good(rc) || data.length > ms_len || > + data.header_length + data.block_descriptor_length > data.length) { n > data.length Tested-by: Kefeng Wang Thanks, Kefeng > /* failed, drive doesn't have capabilities mode page */ > cd->cdi.speed = 1; > cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R | > > > > . >