Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   KY Srinivasan <kys@microsoft.com>
To:     Xiaohui Zhang <ruc_zhangxiaohui@163.com>,
        Haiyang Zhang <haiyangz@microsoft.com>,
        Stephen Hemminger <sthemmin@microsoft.com>,
        Wei Liu <wei.liu@kernel.org>,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        "linux-hyperv@vger.kernel.org" <linux-hyperv@vger.kernel.org>,
        "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [EXTERNAL] [PATCH 1/1] scsi: Fix possible buffer overflows in
 storvsc_queuecommand
Thread-Topic: [EXTERNAL] [PATCH 1/1] scsi: Fix possible buffer overflows in
 storvsc_queuecommand
Thread-Index: AQHWzWTRxBnrkVn9uUeS8hL1fcJMJKntYokQ
Date:   Tue, 8 Dec 2020 16:30:01 +0000
Message-ID: <MW4PR21MB186053CCB0D774831A3B9501A0CD1@MW4PR21MB1860.namprd21.prod.outlook.com>
References: <20201208131918.31534-1-ruc_zhangxiaohui@163.com>
In-Reply-To: <20201208131918.31534-1-ruc_zhangxiaohui@163.com>
Accept-Language: en-US
Content-Language: en-US
msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=b75e7c58-a8c3-47a3-b65d-0409b213bdbb;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-12-08T16:24:55Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;
authentication-results: 163.com; dkim=none (message not signed)
 header.d=none;163.com; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [2601:600:a27f:86b0:15a4:1ab8:b79c:38e5]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 5ed09bea-5e5b-4b75-4a15-08d89b9682f2
x-ms-traffictypediagnostic: MW4PR21MB1908:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <MW4PR21MB1908CFAA0D6CDC0DB1C49DFDA0CD1@MW4PR21MB1908.namprd21.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:2733;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: AE8FUr9z+VCqtHCQUvaOqhevNyS6mFvmaXbA6cjNGTNYcd5odDMAH+nYcAmAOczUxNJpF+TD7ssGZSao1rjANw2u0pY0HZmKs/816WZvLvRaja5kUo0Rtc2hzlz9tVA7dmSdpA7/nCuLXtSzqX8XlPtmrgVIk7VXy2ipW1rNZa9gfiljg1q3JSgM2EniAsdqyy16tlufEnxDKsZfWUmGMXsuYzIZpc6wRBivUE+NIXTDb2BGAIOJNxGz9sebTCjXXeI4mTTGV98bCrZMsjw2pQItTmX79RdqtJQcT9UwhMyZbAoM487p5/nxk4lUNtaQpgasoaMBeGZ4JV+NOPWoLA==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR21MB1860.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(376002)(346002)(39860400002)(366004)(396003)(136003)(55016002)(9686003)(2906002)(82950400001)(82960400001)(10290500003)(8936002)(83380400001)(478600001)(8676002)(33656002)(86362001)(7696005)(52536014)(316002)(5660300002)(71200400001)(6506007)(110136005)(53546011)(64756008)(186003)(66476007)(66556008)(66446008)(8990500004)(66946007)(76116006);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata: =?us-ascii?Q?UDXKHYS5r0J5XmNEu7ZqS23Rzx4CGwEXH/Vr9PZeO1oP8BSh/MQeYLgfbX0L?=
 =?us-ascii?Q?7F4yoUlGcqXtqbMRfUpsvdBFMTbxuVKuLLWEq2O+HcP1OS3ZW5CnKVl5VUiO?=
 =?us-ascii?Q?h3S46wN2UoSHRjco9RphBentlWROTXGQrQdpgSM+ef8zWZCBg6x7CmPNZSLd?=
 =?us-ascii?Q?VJu7sNschxBYicA2QD+lcRewyUaHNpx/LmxC3P9qd9OGXEcXFbFE3F4QX0hC?=
 =?us-ascii?Q?qGmGHC1aF2rk+Chh+8h1RtnjTmYFd4G0ahIATI3kkBYBa5BwwwnBhExT/4wl?=
 =?us-ascii?Q?y3S3Q81iT+itSFfT4YXl14PYWGZE3Wr6PObwDHYQewUPjzBFeoByPBASCygB?=
 =?us-ascii?Q?aZ4NAlXZxRYFNJSiz0JTs5jh8TAcT4EQGsFcoayHTwYLVPJfa1ZSnbYbrh+5?=
 =?us-ascii?Q?3fkziBSAzPIqKWZUPHxm2czHM9JyfU4KJQ+CtHIKrP5HlFwrT9iVxZJJf5SG?=
 =?us-ascii?Q?dKfSzZQEWZ4XzAhHHm30lrgPxr+EHYRveSa21c3ljeVYLlAInfpiqAYKEUE6?=
 =?us-ascii?Q?IXkFF90IlRjjrL4xIMFj5UAUcEBSLxKRcNYGwvLYXrjK5SjbAucJs5b1jzyq?=
 =?us-ascii?Q?TeI0jFxVfQp47ckRdMaKBJbbmM3wwawurOFW4lQ9dEv2o56YymwHyGe6ITU4?=
 =?us-ascii?Q?0nOp4VS05/rtKwnOsw4VlXa5AaOPmpsKWM1cJ7eLGxwse55yajNsX7miT0cq?=
 =?us-ascii?Q?6/uwc22K0wr2cRuNuLPm9LDhx60RunmBA269d3NQJUnsCdH8QpTVB7+8zdK5?=
 =?us-ascii?Q?CvBUUxi0WLYYNKfbSJ7+cDKuv6FaMUmGiTpxU62IkodU3DrN8sEIlsInrzDA?=
 =?us-ascii?Q?W0xQz2deTGcRmHvs3C7Fcm9jj4KvgJEIFAHsyF+p9mNpRH246KDhaKhgR6Te?=
 =?us-ascii?Q?FuzQPi8WKrcITBhf8NWZHosa/3AWVzDfpb1u2IpmryvdsDj4bsMewe5GegZ7?=
 =?us-ascii?Q?UlDdw7/0RiMQQxtLowV0My+Gpl1AVLnSALaNmqyYluCCnf3JMyrIUACSsMvE?=
 =?us-ascii?Q?EcNtP/Awz/7BgbWbgSo96u7KqSiG/6QMydF6NE5WlIRuN8o=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW4PR21MB1860.namprd21.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5ed09bea-5e5b-4b75-4a15-08d89b9682f2
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Dec 2020 16:30:01.6405
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 2GW/7UNSfL8zXJIOGjffL3MZs5DptUmuQ+1+flcDXH6MymU0E55toV8pYo8hePt+xUPKvMB7iek2bOA69/zmTQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR21MB1908
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> -----Original Message-----
> From: Xiaohui Zhang <ruc_zhangxiaohui@163.com>
> Sent: Tuesday, December 8, 2020 5:19 AM
> To: Xiaohui Zhang <ruc_zhangxiaohui@163.com>; KY Srinivasan
> <kys@microsoft.com>; Haiyang Zhang <haiyangz@microsoft.com>; Stephen
> Hemminger <sthemmin@microsoft.com>; Wei Liu <wei.liu@kernel.org>;
> James E.J. Bottomley <jejb@linux.ibm.com>; Martin K. Petersen
> <martin.petersen@oracle.com>; linux-hyperv@vger.kernel.org; linux-
> scsi@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: [EXTERNAL] [PATCH 1/1] scsi: Fix possible buffer overflows in
> storvsc_queuecommand
>=20
> From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
>=20
> storvsc_queuecommand() calls memcpy() without checking the destination si=
ze
> may trigger a buffer overflower, which a local user could use to cause de=
nial of
> service or the execution of arbitrary code.
> Fix it by putting the length check before calling memcpy().
>=20
> Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
> ---
>  drivers/scsi/storvsc_drv.c | 2 ++
>  1 file changed, 2 insertions(+)
>=20
> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c inde=
x
> 0c65fbd41..09b60a4c0 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
> @@ -1729,6 +1729,8 @@ static int storvsc_queuecommand(struct Scsi_Host
> *host, struct scsi_cmnd *scmnd)
>=20
>  	vm_srb->cdb_length =3D scmnd->cmd_len;
>=20
> +	if (vm_srb->cdb_length > STORVSC_MAX_CMD_LEN)
> +		vm_srb->cdb_length =3D STORVSC_MAX_CMD_LEN;
>  	memcpy(vm_srb->cdb, scmnd->cmnd, vm_srb->cdb_length);

The data  structure is sized correctly to handle the max command length. Be=
sides
your check is bogus - you cannot truncate the command!

K. Y
>=20
>  	sgl =3D (struct scatterlist *)scsi_sglist(scmnd);
> --
> 2.17.1