linux-kernel - Re: [PATCH -next] [RFC] scsi: ses: fix slab-out-of-bounds in ses_enclosure_data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 2 Aug 2022 09:19:58 +0800
From:   "zhangwensheng (E)" <zhangwensheng@...weicloud.com>
To:     "Martin K. Petersen" <martin.petersen@...cle.com>,
        Yu Kuai <yukuai1@...weicloud.com>
Cc:     jejb@...ux.ibm.com, linux-scsi@...r.kernel.org,
        linux-kernel@...r.kernel.org, yukuai3@...wei.com,
        yi.zhang@...wei.com
Subject: Re: [PATCH -next] [RFC] scsi: ses: fix slab-out-of-bounds in
 ses_enclosure_data_process

Hi

 From my description, there is still loophole in the previous changes.
can you make a test with the following changes?

diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 0a1734f34587..06b991e27c84 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -559,11 +559,11 @@ static void ses_enclosure_data_process(struct 
enclosure_device *edev,
                         struct enclosure_component *ecomp;

                         if (desc_ptr) {
-                               if (desc_ptr >= buf + page7_len) {
+                               len = (desc_ptr[2] << 8) + desc_ptr[3];
+                               desc_ptr += 4;
+                               if (desc_ptr + len > buf + page7_len) {
                                         desc_ptr = NULL;
                                 } else {
-                                       len = (desc_ptr[2] << 8) + 
desc_ptr[3];
-                                       desc_ptr += 4;
                                         /* Add trailing zero - pushes into
                                          * reserved space */
                                         desc_ptr[len] = '\0';

thanks！

Wensheng

在 2022/8/2 8:01, Martin K. Petersen 写道:
>> After analysis on vmcore, it was found that the line "desc_ptr[len] =
>> '\0';" has slab-out-of-bounds problem in ses_enclosure_data_process.
>> In ses_enclosure_data_process, "desc_ptr" point to "buf", so it have
>> to be limited in the memory of "buf", however. although there is
>> "desc_ptr >= buf + page7_len" judgment, it does not work because
>> "desc_ptr + 4 + len" may bigger than "buf + page7_len", which will
>> lead to slab-out-of-bounds problem.
>>
>> Fix it by using judging desc_ptr cross the border or not after
>> "desc_ptr += 4".
> FWIW, I tested this change and I am still getting KASAN errors from ses.
>