lkml.org 
[lkml]   [2016]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.6 81/96] SCSI: fix new bug in scsi_dev_info_list string matching
    Date
    4.6-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alan Stern <stern@rowland.harvard.edu>

    commit 5e7ff2ca7f2da55fe777167849d0c93403bd0dc8 upstream.

    Commit b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching")
    changed the way vendor- and model-string matching was carried out in the
    routine that looks up entries in a SCSI devinfo list. The new matching
    code failed to take into account the case of a maximum-length string; in
    such cases it could end up testing for a terminating '\0' byte beyond
    the end of the memory allocated to the string. This out-of-bounds bug
    was detected by UBSAN.

    I don't know if anybody has actually encountered this bug. The symptom
    would be that a device entry in the blacklist might not be matched
    properly if it contained an 8-character vendor name or a 16-character
    model name. Such entries certainly exist in scsi_static_device_list.

    This patch fixes the problem by adding a check for a maximum-length
    string before the '\0' test.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Fixes: b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching")
    Tested-by: Wilfried Klaebe <linux-kernel@lebenslange-mailadresse.de>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/scsi/scsi_devinfo.c | 10 ++++++----
    1 file changed, 6 insertions(+), 4 deletions(-)

    --- a/drivers/scsi/scsi_devinfo.c
    +++ b/drivers/scsi/scsi_devinfo.c
    @@ -429,7 +429,7 @@ static struct scsi_dev_info_list *scsi_d
    * here, and we don't know what device it is
    * trying to work with, leave it as-is.
    */
    - vmax = 8; /* max length of vendor */
    + vmax = sizeof(devinfo->vendor);
    vskip = vendor;
    while (vmax > 0 && *vskip == ' ') {
    vmax--;
    @@ -439,7 +439,7 @@ static struct scsi_dev_info_list *scsi_d
    while (vmax > 0 && vskip[vmax - 1] == ' ')
    --vmax;

    - mmax = 16; /* max length of model */
    + mmax = sizeof(devinfo->model);
    mskip = model;
    while (mmax > 0 && *mskip == ' ') {
    mmax--;
    @@ -455,10 +455,12 @@ static struct scsi_dev_info_list *scsi_d
    * Behave like the older version of get_device_flags.
    */
    if (memcmp(devinfo->vendor, vskip, vmax) ||
    - devinfo->vendor[vmax])
    + (vmax < sizeof(devinfo->vendor) &&
    + devinfo->vendor[vmax]))
    continue;
    if (memcmp(devinfo->model, mskip, mmax) ||
    - devinfo->model[mmax])
    + (mmax < sizeof(devinfo->model) &&
    + devinfo->model[mmax]))
    continue;
    return devinfo;
    } else {

    \
     
     \ /
      Last update: 2016-08-08 22:01    [W:2.697 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site