linux-kernel - Re: [PATCH v2 1/2] scsi: ufs: core: Remove unnecessary if statement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <227f117ee9491cc9d2ae4bb2211a99ccd1dd3c21.camel@gmail.com>
Date:   Fri, 14 Oct 2022 22:30:48 +0200
From:   Bean Huo <huobean@...il.com>
To:     Bart Van Assche <bvanassche@....org>, alim.akhtar@...sung.com,
        avri.altman@....com, asutoshd@...eaurora.org, jejb@...ux.ibm.com,
        martin.petersen@...cle.com, stanley.chu@...iatek.com,
        beanhuo@...ron.com, tomas.winkler@...el.com, cang@...eaurora.org,
        daejun7.park@...sung.com
Cc:     linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/2] scsi: ufs: core: Remove unnecessary if statement

On Fri, 2022-10-14 at 11:37 -0700, Bart Van Assche wrote:
> >                 pr_err("Max General LU supported by UFS isn't
> > initialized\n");
> >                 return false;
> >         }
> > -       /* WB is available only for the logical unit from 0 to 7 */
> > -       if (param_offset == UNIT_DESC_PARAM_WB_BUF_ALLOC_UNITS)
> > -               return lun < UFS_UPIU_MAX_WB_LUN_ID;
> >         return lun == UFS_UPIU_RPMB_WLUN || (lun < dev_info-
> > >max_lu_supported);
> >    }
> 
> Hi Bean,
> 
> I think the above patch reintroduces the stack overflow issue fixed
> by
> commit a2fca52ee640 ("scsi: ufs: WB is only available on LUN #0 to
> #7").
> 
> How about reverting commit a2fca52ee640 and fixing the stack overflow
> issue in another way than by modifying ufs_is_valid_unit_desc_lun()?
> 
> Thanks,
> 
> Bart.

Hi Bart, 

I double-checked the changelog and the stack overflow issue was double
fixed by your commit:

commit d3d9c4570285 ("scsi: ufs: Fix memory corruption by
ufshcd_read_desc_param()"),


For example, if the user wants to read wb_buf_alloc_units in the RPMB
unit descriptor,

parameter offset = 41, parameter size = 4,
buff_len = 45;

After ufshcd_query_descriptor_retry(), buff_len will be updated to 35.

param_offset > buff_len, then -EINVAL will be returned.

So we can safely remove this check, and if you still have concerns, I
can verify when I get back to the office.

Kind regards,
Bean