linux-hardening - Re: [PATCH] scsi: megaraid_sas: struct MR_HOST_DEVICE_LIST: Replace 1-element array with flexible array

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58418596-5d8f-4bec-9d4c-64ed8ef0ff9e@embeddedor.com>
Date: Thu, 11 Jul 2024 10:55:57 -0600
From: "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To: Kees Cook <kees@...nel.org>, Kashyap Desai <kashyap.desai@...adcom.com>
Cc: Sumit Saxena <sumit.saxena@...adcom.com>,
 Shivasharan S <shivasharan.srikanteshwara@...adcom.com>,
 Chandrakanth patil <chandrakanth.patil@...adcom.com>,
 "James E.J. Bottomley" <James.Bottomley@...senPartnership.com>,
 "Martin K. Petersen" <martin.petersen@...cle.com>,
 megaraidlinux.pdl@...adcom.com, linux-scsi@...r.kernel.org,
 linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH] scsi: megaraid_sas: struct MR_HOST_DEVICE_LIST: Replace
 1-element array with flexible array



On 11/07/24 09:58, Kees Cook wrote:
> Replace the deprecated[1] use of a 1-element array in
> struct MR_HOST_DEVICE_LIST with a modern flexible array.
> 
> One binary difference appears in megasas_host_device_list_query():
> 
>          struct MR_HOST_DEVICE_LIST *ci;
> 	...
>          ci = instance->host_device_list_buf;
> 	...
>          memset(ci, 0, sizeof(*ci));
> 
> The memset() clears only the non-flexible array fields. Looking at the
> rest of the function, this appears to be fine: firmware is using this
> region to communicate with the kernel, so it likely never made sense to
> clear the first MR_HOST_DEVICE_LIST_ENTRY.

Yeah, clearing that fist entry seems odd/buggy. So, this patch is probably
even fixing a bug. :)

> 
> Link: https://github.com/KSPP/linux/issues/79 [1]
> Signed-off-by: Kees Cook <kees@...nel.org>

Reviewed-by: Gustavo A. R. Silva <gustavoars@...nel.org>

Thanks
-- 
Gustavo

> ---
> Cc: Kashyap Desai <kashyap.desai@...adcom.com>
> Cc: Sumit Saxena <sumit.saxena@...adcom.com>
> Cc: Shivasharan S <shivasharan.srikanteshwara@...adcom.com>
> Cc: Chandrakanth patil <chandrakanth.patil@...adcom.com>
> Cc: "James E.J. Bottomley" <James.Bottomley@...senPartnership.com>
> Cc: "Martin K. Petersen" <martin.petersen@...cle.com>
> Cc: megaraidlinux.pdl@...adcom.com
> Cc: linux-scsi@...r.kernel.org
> ---
>   drivers/scsi/megaraid/megaraid_sas.h | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
> index 84cf77c48c0d..088cc40ae866 100644
> --- a/drivers/scsi/megaraid/megaraid_sas.h
> +++ b/drivers/scsi/megaraid/megaraid_sas.h
> @@ -814,12 +814,12 @@ struct MR_HOST_DEVICE_LIST {
>   	__le32			size;
>   	__le32			count;
>   	__le32			reserved[2];
> -	struct MR_HOST_DEVICE_LIST_ENTRY	host_device_list[1];
> +	struct MR_HOST_DEVICE_LIST_ENTRY	host_device_list[] __counted_by_le(count);
>   } __packed;
>   
>   #define HOST_DEVICE_LIST_SZ (sizeof(struct MR_HOST_DEVICE_LIST) +	       \
>   			      (sizeof(struct MR_HOST_DEVICE_LIST_ENTRY) *      \
> -			      (MEGASAS_MAX_PD + MAX_LOGICAL_DRIVES_EXT - 1)))
> +			      (MEGASAS_MAX_PD + MAX_LOGICAL_DRIVES_EXT)))
>   
>   
>   /*