linux-kernel - Re: [PATCH] scsi: storvsc: Set correct data length for sending SCSI command without payload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c3e23b3f-d83f-431e-b19d-691fae0041cf@linux.microsoft.com>
Date: Fri, 17 Jan 2025 11:11:34 -0800
From: Roman Kisel <romank@...ux.microsoft.com>
To: longli@...uxonhyperv.com, "K. Y. Srinivasan" <kys@...rosoft.com>,
 Haiyang Zhang <haiyangz@...rosoft.com>, Wei Liu <wei.liu@...nel.org>,
 Dexuan Cui <decui@...rosoft.com>,
 "James E.J. Bottomley" <James.Bottomley@...senPartnership.com>,
 "Martin K. Petersen" <martin.petersen@...cle.com>,
 James Bottomley <JBottomley@...n.com>, linux-hyperv@...r.kernel.org,
 linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: Long Li <longli@...rosoft.com>, stable@...nel.org,
 "benhill@...rosoft.com" <benhill@...rosoft.com>
Subject: Re: [PATCH] scsi: storvsc: Set correct data length for sending SCSI
 command without payload

On 1/16/2025 3:59 PM, longli@...uxonhyperv.com wrote:
> From: Long Li <longli@...rosoft.com>
> 
> In StorVSC, payload->range.len is used to indicate if this SCSI command
> carries payload. This data is allocated as part of the private driver
> data by the upper layer and may get passed to lower driver uninitialized.
> 
> If a SCSI command doesn't carry payload, the driver may use this value as
> is for communicating with host, resulting in possible corruption.
> 
> Fix this by always initializing this value.

Awesome that you've caught that elusive critter, thank you! :)

Tested-by: Roman Kisel <romank@...ux.microsoft.com>
Reviewed-by: Roman Kisel <romank@...ux.microsoft.com>

> 
> Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host")
> Cc: stable@...nel.org
> Signed-off-by: Long Li <longli@...rosoft.com>
> ---
>   drivers/scsi/storvsc_drv.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
> index 7ceb982040a5..ca5e5c0aeabf 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
> @@ -1789,6 +1789,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
>   
>   	length = scsi_bufflen(scmnd);
>   	payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb;
> +	payload->range.len = 0;
>   	payload_sz = 0;
>   
>   	if (scsi_sg_count(scmnd)) {

-- 
Thank you,
Roman