linux-kernel - Re: mtip32xx: add a status field to struct mtip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f617c365-4459-6a8c-61a9-7494f8d4166b@kernel.dk>
Date:   Fri, 21 Apr 2017 08:14:03 -0600
From:   Jens Axboe <axboe@...nel.dk>
To:     Colin Ian King <colin.king@...onical.com>,
        Christoph Hellwig <hch@....de>,
        Johannes Thumshirn <jthumshirn@...e.de>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: mtip32xx: add a status field to struct mtip_cmd

On 04/21/2017 08:06 AM, Colin Ian King wrote:
> Hi,
> 
> CoverityScan found an issue with the following part of the patch:
> 
> -       if (likely(!reserv))
> -               blk_mq_complete_request(rq, -ENODEV);
> -       else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
> +       if (likely(!reserv)) {
> +               cmd->status = -ENODEV;
> +               blk_mq_complete_request(rq, 0);
> +       } else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
> 
> 
From: Jens Axboe <axboe@...com>
Subject: [PATCH] mtip32xx: fix dereference of stack garbage

We need to get the command payload from the request before
we attempt to dereference it.

Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
Signed-off-by: Jens Axboe <axboe@...com>

diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 66a6bd83faae..54c8736038de 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4108,6 +4108,7 @@ static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
 	struct mtip_cmd *cmd;
 
 	if (likely(!reserv)) {
+		cmd = blk_mq_rq_to_pdu(rq);
 		cmd->status = -ENODEV;
 		blk_mq_complete_request(rq);
 	} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {

-- 
Jens Axboe