Messages in this thread | | | Subject | Re: [PATCH] scsi: ses: Fix out-of-bounds memory access in ses_enclosure_data_process() | From | Waiman Long <> | Date | Mon, 20 May 2019 11:24:39 -0400 |
| |
On 5/20/19 10:52 AM, James Bottomley wrote: > On Mon, 2019-05-20 at 10:41 -0400, Waiman Long wrote: > [...] >>> --- a/drivers/scsi/ses.c >>> +++ b/drivers/scsi/ses.c >>> @@ -605,9 +605,14 @@ static void ses_enclosure_data_process(struct >>> enclosure_device *edev, >>> /* these elements are optional */ >>> type_ptr[0] == >>> ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || >>> type_ptr[0] == >>> ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || >>> - type_ptr[0] == >>> ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) >>> + type_ptr[0] == >>> ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) { >>> addl_desc_ptr += addl_desc_ptr[1] >>> + 2; >>> >>> + /* Ensure no out-of-bounds memory >>> access */ >>> + if (addl_desc_ptr >= ses_dev- >>>> page10 + >>> + ses_dev- >>>> page10_len) >>> + addl_desc_ptr = NULL; >>> + } >>> } >>> } >>> kfree(buf); >> Ping! Any comment on this patch. > The update looks fine to me: > > Reviewed-by: James E.J. Bottomley <jejb@linux.ibm.com> > > It might also be interesting to find out how the proliant is > structuring this descriptor array to precipitate the out of bounds: Is > it just an off by one or something more serious?
I didn't look into the detail the enclosure message returned by the hardware, but I believe it may have more description entries (page7) than extended description entries (page10).
I can try to reserve the system and find out what exactly is wrong with that system if you really want to find that out.
Cheers, Longman
| |