linux-kernel - Re: [PATCH v2 1/1] scsi: ufs: Fix unexpected values get from ufshcd_read_desc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <28555cab045fb631c91262c77b71d9fc@codeaurora.org>
Date:   Mon, 26 Oct 2020 15:01:45 +0800
From:   Can Guo <cang@...eaurora.org>
To:     Avri Altman <Avri.Altman@....com>
Cc:     asutoshd@...eaurora.org, nguyenb@...eaurora.org,
        hongwus@...eaurora.org, rnayak@...eaurora.org,
        linux-scsi@...r.kernel.org, kernel-team@...roid.com,
        saravanak@...gle.com, salyzyn@...gle.com,
        Alim Akhtar <alim.akhtar@...sung.com>,
        "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Stanley Chu <stanley.chu@...iatek.com>,
        Bean Huo <beanhuo@...ron.com>,
        Bart Van Assche <bvanassche@....org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 1/1] scsi: ufs: Fix unexpected values get from
 ufshcd_read_desc_param()

On 2020-10-26 13:22, Avri Altman wrote:
>> On 2020-10-22 14:37, Avri Altman wrote:
>> >> Since WB feature has been added, WB related sysfs entries can be
>> >> accessed
>> >> even when an UFS device does not support WB feature. In that case, the
>> >> descriptors which are not supported by the UFS device may be wrongly
>> >> reported when they are accessed from their corrsponding sysfs entries.
>> >> Fix it by adding a sanity check of parameter offset against the actual
>> >> decriptor length.s
>> > This should be a bug fix IMO, and be dealt with similarly like
>> > ufshcd_is_wb_attrs or ufshcd_is_wb_flag.
>> > Thanks,
>> > Avri
>> 
>> Could you please elaborate on ufshcd_is_wb_attrs or ufshcd_is_wb_flag?
>> Sorry that I don't quite get it.
> Since this change is only protecting illegal access from sysfs entries,
> I am suggesting to handle it there, just like ufshcd_is_wb_attrs or
> ufshcd_is_wb_flag
> Are doing it for flags and attributes.
> 
> Thanks,
> Avri

This is a general problem - if later we have HPB entries added into 
sysfs,
we will hit it again. We cannot keep adding checks like 
ufshcd_is_xxx_attrs
or ufshcd_is_xxx_flag to block them, right?

Thanks,

Can Guo.