A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

scsi: Protect against buffer possible overflow in scsi_set_sense_information

Browse source 
Make sure that the input sense buffer has sufficient length
to fit the information descriptor (12 additional bytes).
Modify scsi_set_sense_information to receive the sense buffer
length and adjust its callers scsi target and libata.

(Fix patch fuzz in scsi_set_sense_information - nab)

Reported-by: Hannes Reinecke <[email protected]>
Signed-off-by: Sagi Grimberg <[email protected]>
Reviewed-by: Martin K. Petersen <[email protected]>
Cc: Tejun Heo <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Signed-off-by: Nicholas Bellinger <[email protected]>
This commit is contained in:
Sagi Grimberg 2015-07-15 10:55:37 +03:00 • committed by Nicholas Bellinger
commit f5a8b3a796
4 changed files with 27 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
drivers/target/target_core_transport.c
View file

@ -2729,7 +2729,7 @@ static const struct sense_info sense_info_table[] = {
},
};
static void translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason)
static int translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason)
{
const struct sense_info *si;
u8 *buffer = cmd->sense_buffer;
@ -2756,7 +2756,11 @@ static void translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason)
scsi_build_sense_buffer(0, buffer, si->key, asc, ascq);
if (si->add_sector_info)
scsi_set_sense_information(buffer, cmd->bad_sector);
return scsi_set_sense_information(buffer,
cmd->scsi_sense_length,
cmd->bad_sector);
return 0;
}
int
@ -2774,10 +2778,14 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
spin_unlock_irqrestore(&cmd->t_state_lock, flags);
if (!from_transport) {
int rc;
cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
translate_sense_reason(cmd, reason);
cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
cmd->scsi_sense_length = TRANSPORT_SENSE_BUFFER;
rc = translate_sense_reason(cmd, reason);
if (rc)
return rc;
}
trace_target_cmd_complete(cmd);