diff options
| author | Kees Cook <keescook@chromium.org> | 2021-06-16 23:24:28 +0200 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2021-06-19 05:26:33 +0200 |
| commit | 86a6a0bdbe2beb4cc7bc80eccd835b62a1f0c364 (patch) | |
| tree | 29b98b480005668357cfac89dd9798d6eb7cb211 /drivers/scsi | |
| parent | scsi: ips: Avoid over-read of sense buffer (diff) | |
| download | linux-86a6a0bdbe2beb4cc7bc80eccd835b62a1f0c364.tar.xz linux-86a6a0bdbe2beb4cc7bc80eccd835b62a1f0c364.zip | |
scsi: arcmsr: Avoid over-read of sense buffer
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.
pcmd->sense_buffer is 96 bytes, and was being manually zero-filled.
However, struct SENSE_DATA is 18 bytes, with ccb->arcmsr_cdb.SenseData only
being 15 bytes, resulting in a 3 byte over-read.
Copy only the contents of ccb->arcmsr_cdb.SenseData and zero fill the
remainder, avoiding potential over-reads.
Link: https://lore.kernel.org/r/20210616212428.1726958-1-keescook@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/arcmsr/arcmsr_hba.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c index e5149c9fd4e6..ec1a834c922d 100644 --- a/drivers/scsi/arcmsr/arcmsr_hba.c +++ b/drivers/scsi/arcmsr/arcmsr_hba.c @@ -1323,16 +1323,19 @@ static void arcmsr_ccb_complete(struct CommandControlBlock *ccb) static void arcmsr_report_sense_info(struct CommandControlBlock *ccb) { - struct scsi_cmnd *pcmd = ccb->pcmd; - struct SENSE_DATA *sensebuffer = (struct SENSE_DATA *)pcmd->sense_buffer; + pcmd->result = (DID_OK << 16) | SAM_STAT_CHECK_CONDITION; - if (sensebuffer) { - int sense_data_length = - sizeof(struct SENSE_DATA) < SCSI_SENSE_BUFFERSIZE - ? sizeof(struct SENSE_DATA) : SCSI_SENSE_BUFFERSIZE; - memset(sensebuffer, 0, SCSI_SENSE_BUFFERSIZE); - memcpy(sensebuffer, ccb->arcmsr_cdb.SenseData, sense_data_length); + if (pcmd->sense_buffer) { + struct SENSE_DATA *sensebuffer; + + memcpy_and_pad(pcmd->sense_buffer, + SCSI_SENSE_BUFFERSIZE, + ccb->arcmsr_cdb.SenseData, + sizeof(ccb->arcmsr_cdb.SenseData), + 0); + + sensebuffer = (struct SENSE_DATA *)pcmd->sense_buffer; sensebuffer->ErrorCode = SCSI_SENSE_CURRENT_ERRORS; sensebuffer->Valid = 1; } |