From patchwork Fri Aug 5 19:31:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dave Carroll X-Patchwork-Id: 9265699 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A9B6560760 for ; Fri, 5 Aug 2016 19:47:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 951332842E for ; Fri, 5 Aug 2016 19:47:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8972928462; Fri, 5 Aug 2016 19:47:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E5C5A2842E for ; Fri, 5 Aug 2016 19:47:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1946975AbcHETqz (ORCPT ); Fri, 5 Aug 2016 15:46:55 -0400 Received: from mail-bn3nam01on0060.outbound.protection.outlook.com ([104.47.33.60]:51904 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1946364AbcHETqt (ORCPT ); Fri, 5 Aug 2016 15:46:49 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mscc365.onmicrosoft.com; s=selector1-microsemi-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=UGfqRvqafjxKSs6oYSabCSWrpayPPhLeK7pJXHYvBgw=; b=KxhZ6GaGQ7w4HNOuNDJFmVJBiHTQSMQKKNM6GWhdHq8YzDEN2HBKzwehudwdfMMgXGHdvOzKYt3PGA8haXiNq4bf4SfVqJKxe2n0dH/uFZU8S7Em9I0GU+A3rpJNSlZDcuzATiYXCAl2PZvfaVpf6cK59Ht/LpX2E39Q3cu6g/I= Received: from BY2PR02CA0097.namprd02.prod.outlook.com (10.163.44.151) by BY2PR02MB123.namprd02.prod.outlook.com (10.242.43.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.549.15; Fri, 5 Aug 2016 19:32:19 +0000 Received: from BL2FFO11FD022.protection.gbl (2a01:111:f400:7c09::110) by BY2PR02CA0097.outlook.office365.com (2a01:111:e400:5261::23) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.549.15 via Frontend Transport; Fri, 5 Aug 2016 19:32:20 +0000 Authentication-Results: spf=none (sender IP is 208.19.100.21) smtp.mailfrom=microsemi.com; vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=microsemi.com; Received-SPF: None (protection.outlook.com: microsemi.com does not designate permitted sender hosts) Received: from avsrvexchhts1.microsemi.net (208.19.100.21) by BL2FFO11FD022.mail.protection.outlook.com (10.173.161.101) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.557.8 via Frontend Transport; Fri, 5 Aug 2016 19:32:20 +0000 Received: from localhost.localdomain (10.225.65.2) by avsrvexchhts1.microsemi.net (10.100.34.105) with Microsoft SMTP Server id 14.3.301.0; Fri, 5 Aug 2016 12:32:03 -0700 From: Dave Carroll To: James Bottomley , "Martin K . Petersen" CC: , , , Dave Carroll , Linux-SCSI , Johannes Thumshurn , Subject: [PATCH] aacraid: Check size values after double-fetch from user Date: Fri, 5 Aug 2016 13:31:24 -0600 Message-ID: <20160805193124.6318-1-david.carroll@microsemi.com> X-Mailer: git-send-email 2.8.4 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:208.19.100.21; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(6009001)(7916002)(2980300002)(428002)(189002)(199003)(5003940100001)(2906002)(106466001)(4326007)(97736004)(48376002)(36756003)(189998001)(68736007)(229853001)(19580405001)(77096005)(1076002)(15975445007)(19580395003)(50226002)(104016004)(50466002)(8676002)(11100500001)(92566002)(47776003)(105586002)(586003)(87936001)(8936002)(69596002)(49486002)(50986999)(305945005)(5001770100001)(7846002)(33646002)(81156014)(86362001)(101416001)(356003)(81166006); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR02MB123; H:avsrvexchhts1.microsemi.net; FPR:; SPF:None; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11FD022; 1:/sE/buH6QupP/fUZ/slmT4QOuH9WzNbyVKQBAUB+h7vYQ+wwC+pTpn3O0Vjpmxi1yLLCtujY9+YkikNeR5MRN+7c2NcOv8q6/1uprHHS9KktcH7BPrSZidnFIm/o2J/Bmfk8gqaCc6rZzFULsW2A7DpGLUVQJyhvON2SGcSbKtr+kavgVMB6yz2doEGGMybwkQXhKe77bDi6uTSG/9cXLPaSJILGLV9aCcJJUYx9nudMa3yinlb48Aats3Nw6bu3tuWKuQNv80GVlbF9EaxXw1EWZFRx7oLfLPoj1wkJ+pKHQOW2d3bUmLE6RSuUHw9rdSldIXGVeYOFuYXYAjrfpiReepOod2AFlIwFAtJbi4vt8u89GgD5yQ77qLegSzzu+H9/fM+cH/UDCNAUjcEtO/oN37uQ8pbWm641ne9h/KwfnHQeK638H0gRbn/KJqvzRbnpykWWL1/QjizeajUbiCWkJXksVU5cephSs5VsGPTl7Hoye1y2eNM6QwXnyemx1bSzrlhFGKOUMzcCR9QvYAuLVYoA3rzWt+mTCIG+rL8= X-MS-Office365-Filtering-Correlation-Id: 6ef4880d-4356-475a-fd8b-08d3bd6737c1 X-Microsoft-Exchange-Diagnostics: 1; BY2PR02MB123; 2:SKttuJmhcb+9LD8Xe7jNB9YG5vRmWlde1B7/FArxCuSUKfM0Ii2Xw2H4CfAsoK1MnqqgLye+JNd1DevFmlZD18ow2o5eucsIZZ1nG5N8WbGkzsM0kD3tMpEOSQqU4GS4BzHALUtKWri04tSuEFuCrx/twiF9qSbT4vvItS1AYzPphNRE0QYZ6hS9bkWHeqP6; 3:+9XdS5ygv4kJPMAE/noW/jl8iw2EwVwi8lTq0h7HC4T6d9siiqxf/AWEMJTaNqIeZz7s6nvDJH93KR3B6O01BCAtniqRcPAf70qaOAjuLFpuN0OBlNDjdI2VHg5IYtVaxlzYAd8rSj0BL/ATI13vIyupcUXLyrXr+omCsoFMZQB6p0NCCnLT66XdSAxZkiVfbR8ZKbqPQzFaVxEFJsFjpqCv8FhGYfcwB5FOPmroukU=; 25:8IwsEUbJRqyyjtvXsrtq8AYlGRdbqNSlXkMx4IScxazGKrCmmpPEUwkeqT8I0u8nrZ5YrtdcyXe1TW+L/fUip2nW4274c80JfNuZAww2NUiZfzXphs8wUZiv5BPRsHusVhkNuAelOVnxN8WZUH2+8szKWs155fDEigOTEqggTfVDKzyLE842lxrxeUINGlxToAuia8DgbT9uUwh3hohkcRdbobCj95K4PDV5mnPlW/HQjSUKeI4SINLgVAuQ7lkZxZrbJ8zifQcINQKxRJw+q8Sa6/AF8GQcnBQcsv8Hq8fIZDkKmum1JHRCnp29pRYGFkl3hQ6Jna/ESK1NN0BzBiiHUUMM+tajSeVXRlQlcOe5/TOHzN5iU9hD+j2D3shsfpMltldSeQdLSKqnunT9HNYubLC8v59Uh/KQUi8IyPI= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY2PR02MB123; X-Microsoft-Exchange-Diagnostics: 1; BY2PR02MB123; 31:6upJAybfEpCD9sIv9J2yz5st37gKJD7+fJHEcx1DfzNvgHNb5OA5xpJHJvfdM1gbnyYd72BkZOw8YCaeLwZpIUfXVPP8RPMlJFiJKGxltzBCHyxy+LGgiKoCbnk9CddxKBIYbCxMNWV7hbeSaxm4zwlaxnq0gnEkHwQdMFEuUI3qwl3RhiXXkxdSX4IPDUDyTWxPnplgxzorZmSAmkA1ZmXMsKmAkcRvWP9TsnjRTMc=; 20:ouNOICC4xT8aC7i1BZwNiVp6YOREOz8KcIxd6v8ULTIdliXgFJszaOZoyG4gpyMugWMgdRZZbbgTk5h8juT5orIZFOZXpS1FyI3NRp2ntn6sudt0HBIc5qQuCdmsIh402sPXamQIJ9ZHwBshufQA5TKI+Np5mApMQPGyrTqV2QQ55S1vskfZIecwk6VR4G04DXGhY5SHLz7LXMNdHSfna7eWiw8Bx/j4h5OroBEcL8uDnOPKBD1UekvA54+7jUfI2C2lybY5iGGAc9UwmDsbYmCYImEktvc3YG6VY/Ze00Z4+ItrH/WxRg0OufoHI4xcvuxbnpALLuVHktZL9zxZLkMPmnLsx8Eo8d60OGbbnKsPIBF58oliXDDvORT01Q1wiOq3G80lZCMDJ340h3QHaE1xdpb0IR2rBCQGKefNaDFHeB3k85jtixU8FR2exfc5RwAcIDk96grof/o0VW7Mk2Azb5Fmq4l5hiUKkzgdD7LEuekFbYW0kpCYGuhKrlR4 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(72170198267865); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(2401047)(13023025)(13024025)(13015025)(13018025)(13017025)(5005006)(8121501046)(3002001)(10201501046); SRVR:BY2PR02MB123; BCL:0; PCL:0; RULEID:; SRVR:BY2PR02MB123; X-Microsoft-Exchange-Diagnostics: 1; BY2PR02MB123; 4:8VD16O0iKkqrlDo89A5vvosKIktNllVo70Psmd5iKG86BIakfx6vjBXb0Ot9HOq2NyvAF8bJFfDk/SeFauVhpkUVZUZo601eb8pfHBzXWRhKaeAgvj1EfGbulcYevGgl7/ZaniSf9MOmDmifdfsbFM0FeOqo81/rARL8mB43REOinxRllOm/7z22mGzjNMoC7hJOBic3L4B/0ezp7o2+Wo7w+dRYJhBHD76GwRqJ6q0TCIIJexGeD/KEqhp8s3Nda+KRl0bVnXlQF35PSws7H4DbfBGVR+z0l4psp5894/325RhU5PlOxdV62S2w/B4eeUj7n4VdluHZznhCRh7YPeFomIOhPi2T+ZLXN7cMILfnodllv0jSCscU61fromLPtjleLBnH0xHUS68OSKOIFYr22te/2wGuoq/suE/VMxIPPnnvH0eO+9MIxvd4Oy3EMsmck6SiVNmhtthhAKTJXqGNXpQDiG1esdYEqZ0MrdlGXNO5EoLybjeOX5P1cJxFaM39meu0D/6+ZKnMoVEZOHzac9Rz+NvUEb+dA5lJQH4= X-Forefront-PRVS: 0025434D2D X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BY2PR02MB123; 23:PtoeDu6vwM69jvD3gO2T8TbYZ3q674e+hIKnCLBslK?= =?us-ascii?Q?+mVcjgPbB+QN/LJEmnSx2nBI9tf68xIRyVe3V9HwAY5E1IHNM3ojAw4aBry4?= =?us-ascii?Q?IpQY3r0h44yBVE49iSu88MLeoBKP7QzYWKHgMPBwnLRRX79ko2BHM0vMye5f?= =?us-ascii?Q?3cn6+64s6TgaFL6uAflq7TQTpYqGeOvS7SGeJUz4paiNQu+rupJ8lr6Gr93e?= =?us-ascii?Q?9x/6usZffjkr4tB8pqBqyZUU10ulA7KuQxZ79dY6qMJ4X1NIbY4aYgQGUArL?= =?us-ascii?Q?mjd8PXVxOkmc+f1rRZTfBpvGT2toR5PWayqXCCePQ3KE4R4CNoG2ODgwEzvs?= =?us-ascii?Q?616/BQa8L8t5SQxrzVNcwsoSCGcdvWxWiSTwkReyZE15hdIOYBFcBp3wxtiY?= =?us-ascii?Q?q1VSE2mukmVPv/vFWPSgsxwkSYTFlX8KFfJjfYTGXEPdH55CoaarxhHl37d8?= =?us-ascii?Q?yRMj25RpsoDt+CBK7uH/DdYe405sbmE4uT4lJp+hToNoIxUFjP3Wpg3d0Y7J?= =?us-ascii?Q?tfcjg37uJ8BToDf2vUbBJIAXadmCLF8EWXUDadsnqZ65p1aU0P34Ng15C9+s?= =?us-ascii?Q?E7Y4T+6dsHQd68Il+XR4wC2T+hERtZF2RmwfeLh9ySpRX7o+wQJ/ADHeYav0?= =?us-ascii?Q?pX+xiSl9O0isOwZ0XcNf1qh/5GO4O5cIKg+sqxyT08lWl/D1MUSkuxLA1RVn?= =?us-ascii?Q?DkJu2UwY+HS89Z01QSHX0hd+ZfZKhugwK43PKvbAUU9oo+E047bSCQQHPmod?= =?us-ascii?Q?NVSwluHSE3lG1lMs4O+dH7CZ2bbKl31rcPZzEaPR5GqC1CH1W6snwLfG71hK?= =?us-ascii?Q?OnUpDeBItb7elDcVz37yLxQno3/qWSZVcPBGG9XMSW/FRV7rJmxjAYgMFt4S?= =?us-ascii?Q?NYy4/RX3Y9IDC9XpYHXE+8S/bL210+DJYA67mkcrzPssWy400JmhE7nM2AZo?= =?us-ascii?Q?wcS4wDABTP9a88XGdAsxAbGjWap9U/Y+Grbp6nK4cbzxwwDb5o5C8APH/Tuh?= =?us-ascii?Q?N3ScM2v5EBl2//ckoUGiaxAl0Mtk15iagaatHVl6Hmy8nbzDUYfJSaqq7F5d?= =?us-ascii?Q?zJ+jvuHuMGWXcJ1nSvnXmiy672?= X-Microsoft-Exchange-Diagnostics: 1; BY2PR02MB123; 6:NlKoKQ5g4NvhbESzfyJpGFoFIU1n5BJw535AJ3fGTU7tR0W1TuNcO0xHzWJyECGSxmC524LGnDuxDJdhuEi+Xg6wvRZIj7a24x2HG2duEqLu+KgvPigUwoC8bbn+BXDMpD0GyCszVkf5xzRriOx75Jx6j35vsd26CyP++Kq7+OmVd+2Ct+Vmv+yESYF7DsTokIbX/cjhZh1Zc6C5ZAUzqYzFYKBTVYlHPg9XOStmurncgayoUEW3uqArZn43NY/g8wLudemTvpfHnbc5bq5SPZGdbyZUumInDQnGjK3Ufps=; 5:qhdT1aiRHLm4xn0u4oiMe+Nmb4u6g8aGhXpbUTbEkUhkCnumscyaOP0vU9YV3+nkKQr5K4JxzaQ//2UyfnkpYEK6E42SG7hn+tul7ag/FW8bR3FtUA70Q7PmitoMOmcEqlh/CTZqlPso6knaDbwMGw==; 24:cvyFelwdAh6FH+SdDcjUi+d7LHm72JjN2MAdm27CIFfX7yZRaBr7Nx9FPHK9DjJ3oxFsui8SxxYesVe+b556as7KN3SBHEMAIlGkcs4zoHc=; 7:/MmhutVIIf0LcBa9RHI1YJgruKPyNI4OUZbAitHD4qi8g3N6aO6d1gGUcP9RNv6gWsA+Ud4Cxeyxsqq1NIsZ4WSIb1Vr51EylEDLI1gz4/e5/WTB1N+C33iyP/Q7NDM+Yq3iKISYACAq/jgY4Wk0s8wj50f0ZcEkbSqCXiTULPTqTYA3wRzq0P8wOtkIUMjSFs6i+pZhc0Dsp9pMGBTF/kdiYPRIEpgdS7s8vvfef7hpkvCwmY2z+xxvJvQPp3Py SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: microsemi.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Aug 2016 19:32:20.0837 (UTC) X-MS-Exchange-CrossTenant-Id: f267a5c8-86d8-4cc9-af71-1fd2c67c8fad X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f267a5c8-86d8-4cc9-af71-1fd2c67c8fad; Ip=[208.19.100.21]; Helo=[avsrvexchhts1.microsemi.net] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR02MB123 Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In aacraid's ioctl_send_fib() we do two fetches from userspace, one the get the fib header's size and one for the fib itself. Later we use the size field from the second fetch to further process the fib. If for some reason the size from the second fetch is different than from the first fix, we may encounter an out-of- bounds access in aac_fib_send(). We also check the sender size to insure it is not out of bounds. This was reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was assigned CVE- 2016-6480. Reported-by: Pengfei Wang Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)' Cc: stable@vger.kernel.org Signed-off-by: Dave Carroll --- drivers/scsi/aacraid/commctrl.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index b381b37..eadca7b 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) struct fib *fibptr; struct hw_fib * hw_fib = (struct hw_fib *)0; dma_addr_t hw_fib_pa = (dma_addr_t)0LL; - unsigned size; + unsigned size, osize; int retval; if (dev->in_reset) { @@ -87,7 +87,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) * will not overrun the buffer when we copy the memory. Return * an error if we would. */ - size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); + osize = size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); if (size < le16_to_cpu(kfib->header.SenderSize)) size = le16_to_cpu(kfib->header.SenderSize); if (size > dev->max_fib_size) { @@ -117,6 +117,13 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) retval = -EFAULT; goto cleanup; } + + /* Sanity check the second copy */ + if ((osize != le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr)) + || (size < le16_to_cpu(kfib->header.SenderSize))) { + retval = -EINVAL; + goto cleanup; + } if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { aac_adapter_interrupt(dev);