linux-kernel - RE: [PATCH] scsi: ufs: Fix unexpected values get from ufshcd_read_desc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BN7PR08MB5684527CDF23C3A49B7827C7DB1C0@BN7PR08MB5684.namprd08.prod.outlook.com>
Date:   Wed, 21 Oct 2020 10:28:05 +0000
From:   "Bean Huo (beanhuo)" <beanhuo@...ron.com>
To:     Can Guo <cang@...eaurora.org>,
        "asutoshd@...eaurora.org" <asutoshd@...eaurora.org>,
        "nguyenb@...eaurora.org" <nguyenb@...eaurora.org>,
        "hongwus@...eaurora.org" <hongwus@...eaurora.org>,
        "rnayak@...eaurora.org" <rnayak@...eaurora.org>,
        "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
        "kernel-team@...roid.com" <kernel-team@...roid.com>,
        "saravanak@...gle.com" <saravanak@...gle.com>,
        "salyzyn@...gle.com" <salyzyn@...gle.com>
CC:     Alim Akhtar <alim.akhtar@...sung.com>,
        Avri Altman <avri.altman@....com>,
        "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Stanley Chu <stanley.chu@...iatek.com>,
        Bart Van Assche <bvanassche@....org>,
        open list <linux-kernel@...r.kernel.org>
Subject: RE:  [PATCH] scsi: ufs: Fix unexpected values get from
 ufshcd_read_desc_param()

Can,

> Since WB feature has been added, WB related sysfs entries can be accessed
> even when an UFS device does not support WB feature. In that case, the
> descriptors which are not supported by the UFS device may be wrongly reported
> when they are accessed from their corrsponding sysfs entries.
> Fix it by adding a sanity check of parameter offset against the actual decriptor
> length.
> 
> Signed-off-by: Can Guo <cang@...eaurora.org>
> 
> diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index
> a2ebcc8..8861ad6 100644
> --- a/drivers/scsi/ufs/ufshcd.c
> +++ b/drivers/scsi/ufs/ufshcd.c
> @@ -3184,13 +3184,19 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
>  	/* Get the length of descriptor */
>  	ufshcd_map_desc_id_to_length(hba, desc_id, &buff_len);
>  	if (!buff_len) {
> -		dev_err(hba->dev, "%s: Failed to get desc length", __func__);
> +		dev_err(hba->dev, "%s: Failed to get desc length\n", __func__);
> +		return -EINVAL;
> +	}
> +
> +	if (param_offset >= buff_len)
> +		dev_err(hba->dev, "%s: Invalid offset 0x%x in descriptor IDN
> 0x%x, length 0x%x\n",
> +			__func__, param_offset, desc_id, buff_len);
>  		return -EINVAL;
>  	}

A brace missed!  This right brace misses a left brace.

Bean