linux-kernel - Re: [Bug] UBSAN: shift-out-of-bounds in sg_build

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 11 Apr 2024 09:17:48 +0800
From: Sam Sun <samsun1006219@...il.com>
To: Bart Van Assche <bvanassche@....org>
Cc: linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org, 
	martin.petersen@...cle.com, jejb@...ux.ibm.com, dgilbert@...erlog.com, 
	syzkaller@...glegroups.com, xrivendell7@...il.com
Subject: Re: [Bug] UBSAN: shift-out-of-bounds in sg_build_indirect

On Wed, Apr 10, 2024 at 12:59 AM Bart Van Assche <bvanassche@....org> wrote:
>
> On 4/9/24 05:51, Sam Sun wrote:
> > We further analyzed the root cause of this bug. In function
> > sg_build_indirect of drivers/scsi/sg.c, variable order of line 1900 is
> > calculated out using get_order(num), and num comes from
> > scatter_elem_sz. If scatter_elem_sz is equal or below zero, the order
> > returned will be 52, so that PAGE_SHIFT + order is 64, which is larger
> > than 32 bits int range, causing shift-out-of bound. This bug is tested
> > and still remains in the latest upstream linux (6.9-rc3).
> > If you have any questions, please contact us.
>
> Thank you for having root-caused this issue and also for having shared
> your root-cause analysis. Do you perhaps plan to post a patch that fixes
> this issue?
>
> Thanks,
>
> Bart.
>

Sure, I am glad to help! But it is my first time submitting a patch, I
need to find some instructions. I would appreciate if you could help
me out. Also, I need to double check the patch to avoid introducing a
new one. It might take some time.

Best,
Yue