[PATCH 4.9 30/72] scsi: sg: check length passed to SG_NEXT_CMD_LEN

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.9 30/72] scsi: sg: check length passed to SG_NEXT_CMD_LEN
Date	Thu, 06 Apr 2017 11:30:03 +0200
Message-ID	<ttbTR-6GC-65@gated-at.bofh.it> (permalink)
References	<ttbh7-6aP-3@gated-at.bofh.it>
X-Mailer	git-send-email 2.12.2
User-Agent	quilt/0.65
MIME-Version	1.0
Content-Type	text/plain; charset=UTF-8
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	32
Organization	linux.* mail to news gateway
X-Original-Cc	Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Peter Chang <dpf@google.com>, Douglas Gilbert <dgilbert@interlog.com>, "Martin K. Petersen" <martin.petersen@oracle.com>
X-Original-Date	Thu, 6 Apr 2017 10:38:17 +0200
X-Original-Message-ID	<20170406083621.195859388@linuxfoundation.org>
X-Original-References	<20170406083619.775985942@linuxfoundation.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1617783

Show key headers only | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: peter chang <dpf@google.com>

commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/sg.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -998,6 +998,8 @@ sg_ioctl(struct file *filp, unsigned int
 		result = get_user(val, ip);
 		if (result)
 			return result;
+		if (val > SG_MAX_CDB_SIZE)
+			return -ENOMEM;
 		sfp->next_cmd_len = (val > 0) ? val : 0;
 		return 0;
 	case SG_GET_VERSION_NUM:

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 4.9 30/72] scsi: sg: check length passed to SG_NEXT_CMD_LEN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:30 +0200

csiph-web