From patchwork Fri Sep 23 11:22:26 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Borislav Petkov X-Patchwork-Id: 9347907 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 83EA0607D0 for ; Fri, 23 Sep 2016 11:22:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6A9D12AAC4 for ; Fri, 23 Sep 2016 11:22:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5D6E72AADE; Fri, 23 Sep 2016 11:22:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 350682AAC4 for ; Fri, 23 Sep 2016 11:22:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932127AbcIWLWg (ORCPT ); Fri, 23 Sep 2016 07:22:36 -0400 Received: from mail.skyhub.de ([78.46.96.112]:60181 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755175AbcIWLWf (ORCPT ); Fri, 23 Sep 2016 07:22:35 -0400 X-Virus-Scanned: Nedap ESD1 at mail.skyhub.de Received: from mail.skyhub.de ([127.0.0.1]) by localhost (door.skyhub.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id oQVpkxbYLBvX; Fri, 23 Sep 2016 13:22:34 +0200 (CEST) Received: from pd.tnic (p200300454B3CAD00D030AE9689A212A1.dip0.t-ipconnect.de [IPv6:2003:45:4b3c:ad00:d030:ae96:89a2:12a1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id C1B751DA20E; Fri, 23 Sep 2016 13:22:33 +0200 (CEST) Received: by pd.tnic (Postfix, from userid 1000) id CA1701603DF; Fri, 23 Sep 2016 13:22:26 +0200 (CEST) Date: Fri, 23 Sep 2016 13:22:26 +0200 From: Borislav Petkov To: "Martin K. Petersen" Cc: Dan Carpenter , "James E.J. Bottomley" , Ching Huang , Hannes Reinicke , Johannes Thumshirn , Tomas Henzl , linux-scsi@vger.kernel.org, security@kernel.org Subject: Re: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer() Message-ID: <20160923112226.rteir5ivjou64ffh@pd.tnic> References: <20160915134456.GA30277@mwanda> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/ (1.7.0) Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Sep 15, 2016 at 09:59:01AM -0400, Martin K. Petersen wrote: > >>>>> "Dan" == Dan Carpenter writes: > > Dan> We need to put an upper bound on "user_len" so the memcpy() doesn't > Dan> overflow. > > Applied to 4.9/scsi-queue. Yap, Tomas said the kfree was missing on the error path but can we simplify this further by doing the user_len check first so that the kfree() is not even needed? Patch ontop: Reviewed-by: Johannes Thumshirn Reviewed-by: Tomas Henzl --- From: Borislav Petkov Date: Fri, 23 Sep 2016 13:04:51 +0200 Subject: [PATCH] scsi: arcmsr: Simplify user_len checking Do the user_len check first and then the ver_addr allocation so that we can save us the kfree() on the error path when user_len is > ARCMSR_API_DATA_BUFLEN. Signed-off-by: Borislav Petkov Cc: Marco Grassi Cc: Dan Carpenter Cc: Tomas Henzl Cc: Martin K. Petersen --- drivers/scsi/arcmsr/arcmsr_hba.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c index 110eca9eaca0..3d53d636b17b 100644 --- a/drivers/scsi/arcmsr/arcmsr_hba.c +++ b/drivers/scsi/arcmsr/arcmsr_hba.c @@ -2391,18 +2391,20 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, uint32_t user_len; int32_t cnt2end; uint8_t *pQbuffer, *ptmpuserbuffer; - ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC); - if (!ver_addr) { + + user_len = pcmdmessagefld->cmdmessage.Length; + if (user_len > ARCMSR_API_DATA_BUFLEN) { retvalue = ARCMSR_MESSAGE_FAIL; goto message_out; } - ptmpuserbuffer = ver_addr; - user_len = pcmdmessagefld->cmdmessage.Length; - if (user_len > ARCMSR_API_DATA_BUFLEN) { + + ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC); + if (!ver_addr) { retvalue = ARCMSR_MESSAGE_FAIL; - kfree(ver_addr); goto message_out; } + ptmpuserbuffer = ver_addr; + memcpy(ptmpuserbuffer, pcmdmessagefld->messagedatabuffer, user_len); spin_lock_irqsave(&acb->wqbuffer_lock, flags);