lkml.org 
[lkml]   [2019]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 055/135] libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
    Date
    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit 71d6c505b4d9e6f76586350450e785e3d452b346 ]

    Jeffrin reported a KASAN issue:

    BUG: KASAN: global-out-of-bounds in ata_exec_internal_sg+0x50f/0xc70
    Read of size 16 at addr ffffffff91f41f80 by task scsi_eh_1/149
    ...
    The buggy address belongs to the variable:
    cdb.48319+0x0/0x40

    Much like commit 18c9a99bce2a ("libata: zpodd: small read overflow in
    eject_tray()"), this fixes a cdb[] buffer length, this time in
    zpodd_get_mech_type():

    We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be
    ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes.

    Reported-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
    Fixes: afe759511808c ("libata: identify and init ZPODD devices")
    Link: https://lore.kernel.org/lkml/201907181423.E808958@keescook/
    Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
    Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/ata/libata-zpodd.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
    index 173e6f2dd9af0..eefda51f97d35 100644
    --- a/drivers/ata/libata-zpodd.c
    +++ b/drivers/ata/libata-zpodd.c
    @@ -56,7 +56,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
    unsigned int ret;
    struct rm_feature_desc *desc;
    struct ata_taskfile tf;
    - static const char cdb[] = { GPCMD_GET_CONFIGURATION,
    + static const char cdb[ATAPI_CDB_LEN] = { GPCMD_GET_CONFIGURATION,
    2, /* only 1 feature descriptor requested */
    0, 3, /* 3, removable medium feature */
    0, 0, 0,/* reserved */
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-08-22 19:26    [W:4.056 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site