[PATCH 4.9 30/72] scsi: sg: check length passed to SG_NEXT_CMD_LEN

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.9 30/72] scsi: sg: check length passed to SG_NEXT_CMD_LEN
Date	2017-04-06 11:30 +0200
Message-ID	<ttbTR-6GC-65@gated-at.bofh.it> (permalink)
References	<ttbh7-6aP-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: peter chang <dpf@google.com>

commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/sg.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -998,6 +998,8 @@ sg_ioctl(struct file *filp, unsigned int
 		result = get_user(val, ip);
 		if (result)
 			return result;
+		if (val > SG_MAX_CDB_SIZE)
+			return -ENOMEM;
 		sfp->next_cmd_len = (val > 0) ? val : 0;
 		return 0;
 	case SG_GET_VERSION_NUM:

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 4.9 30/72] scsi: sg: check length passed to SG_NEXT_CMD_LEN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:30 +0200

csiph-web