linux-kernel - RE: [PATCH] scsi: ufs: core: Fix memory crash in case arpmb command failed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <PH0PR16MB42454F50A606CC55274124F4F4FA2@PH0PR16MB4245.namprd16.prod.outlook.com>
Date: Tue, 18 Feb 2025 09:29:46 +0000
From: Arthur Simchaev <Arthur.Simchaev@...disk.com>
To: Bean Huo <huobean@...il.com>, "martin.petersen@...cle.com"
	<martin.petersen@...cle.com>
CC: Avri Altman <Avri.Altman@...disk.com>, Avi Shchislowski
	<Avi.Shchislowski@...disk.com>, "beanhuo@...ron.com" <beanhuo@...ron.com>,
	"linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"bvanassche@....org" <bvanassche@....org>
Subject: RE: [PATCH] scsi: ufs: core: Fix memory crash in case arpmb command
 failed

Done

-----Original Message-----
From: Bean Huo <huobean@...il.com> 
Sent: Monday, February 17, 2025 8:40 PM
To: Arthur Simchaev <Arthur.Simchaev@...disk.com>; martin.petersen@...cle.com
Cc: Avri Altman <Avri.Altman@...disk.com>; Avi Shchislowski <Avi.Shchislowski@...disk.com>; beanhuo@...ron.com; linux-scsi@...r.kernel.org; linux-kernel@...r.kernel.org; bvanassche@....org
Subject: Re: [PATCH] scsi: ufs: core: Fix memory crash in case arpmb command failed

On Mon, 2025-02-17 at 18:43 +0200, Arthur Simchaev wrote:
> In case the device doesn't support arpmb, the kernel get memory crash 
> due to copy user data in bsg_transport_sg_io_fn level. So in case 
> ufshcd_send_bsg_uic_cmd returned error, do not change the job's 
> reply_len.
> 
> Memory crash backtrace:
> 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -
> 22


It is Advanced RPMB access and not related to the UIC command, 

If the deivce didn't support advanced rpmb, got return -EINVAL(-22). 

In this case, in bsg_transport_sg_io_fn, 

if (job->result < 0) {
	job->reply_len = sizeof(u32); 

then:

 int len = min(hdr->max_response_len, job->reply_len); 
	if (copy_to_user(uptr64(hdr->response), job->reply, len))


It looks like you didn't initialize the correct response buffer from user space.

Could you rephrase your commit message, add a Fixes tag, and resubmit?


Kind regards,
Bean