Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp686326pxu; Fri, 11 Dec 2020 11:42:38 -0800 (PST) X-Google-Smtp-Source: ABdhPJw9pom2X+8xQMIxtnTJgA7sh/l9FG9BNuVMJB6Dpz9UfukRkWHVd4OhGNaTqk5sMnj2vYlL X-Received: by 2002:a17:906:524a:: with SMTP id y10mr12606447ejm.97.1607715758471; Fri, 11 Dec 2020 11:42:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1607715758; cv=none; d=google.com; s=arc-20160816; b=T74lADX4gyvQtlNdI6WKxfvs5/ZemA3Ria4UtB5g1jqPirLAC1X/yNg9QIroOBkYJv wiAK6JuNXn8aT0cxhhjUOIYQjRE694jdNq8afxs6YFokhCFJExe6vPZM8aOG47bAo3KI v6oAEskAMtf3MGdqROonLhgwOCMTrs4odtnYnndFp76+EPtAUvq6IqbPLtsrYK65fASP ozd1cHjXAmCa74xFEeTyYCcUipkhEWPjX6oQH63ew7WdhjJDv4OhFJsC4MJJhkmgObAe qvSDxo60KNxG7wxLLza3fHYpWIP3rTvHScvI/nQD+o3YcZR5n/dBOwHHq1MftS9CkwO3 cMEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=7ATVnQsIMmZ2PzphnnwcEQz2EMeAkjcMfVefIr/j7Pg=; b=iwQo9BIOhHvs8axcPfs1/YZUnYILxALZAIo8GZRkBjDDmQn6AtZHB25PePk+tEFfyK 4Yu5SOfWuJbgaMpSKudOlMCnKi2Y+PBITSNMwUWZt+aYjnzthzoi/6FcMrovaANOUJLH jVvN6qkM/irUE31hd0DVJVbEKHrMb2IGXtxWHDl1m8U/JRLg9d3OPRUEOkQLsrk/X/eq H0uChDaW9zDiGKs3RfwWlvommJQda+7Gd6dm//eiimmK6yfgHY2ENOhFoXb7Y2sfin+O FR3uFpZsjAFInVFXfLZKAgwN1fpgwLEQTil9a5waOWbjHHwEq4zhtxQ7S6LcLV+EP52q kNAg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id cq3si5469729edb.72.2020.12.11.11.42.16; Fri, 11 Dec 2020 11:42:38 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392395AbgLKTjY (ORCPT + 99 others); Fri, 11 Dec 2020 14:39:24 -0500 Received: from mail.kernel.org ([198.145.29.99]:39980 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387585AbgLKTjI (ORCPT ); Fri, 11 Dec 2020 14:39:08 -0500 From: Jaegeuk Kim Authentication-Results: mail.kernel.org; dkim=permerror (bad message/signature format) To: linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org, kernel-team@android.com Cc: cang@codeaurora.org, alim.akhtar@samsung.com, avri.altman@wdc.com, bvanassche@acm.org, martin.petersen@oracle.com, stanley.chu@mediatek.com, Jaegeuk Kim Subject: [PATCH] scsi: ufs: fix memory boundary check for UFS 3.0 Date: Fri, 11 Dec 2020 11:38:14 -0800 Message-Id: <20201211193814.1709484-1-jaegeuk@kernel.org> X-Mailer: git-send-email 2.29.2.576.ga3fc446d84-goog MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jaegeuk Kim If param_offset is greater than what UFS supports, it'll give kernel panic. Signed-off-by: Jaegeuk Kim Change-Id: I48ea6f3f3074bd42abf4ecf8be87806732f3e6a3 --- drivers/scsi/ufs/ufshcd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index d6a3a0ba6960..04687661d0df 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -3194,6 +3194,9 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, return -EINVAL; } + if (param_offset > buff_len) + return -EINVAL; + /* Check whether we need temp memory */ if (param_offset != 0 || param_size < buff_len) { desc_buf = kmalloc(buff_len, GFP_KERNEL); -- 2.29.2.576.ga3fc446d84-goog