Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3524726pxf; Mon, 15 Mar 2021 11:29:05 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzZ5v/w/bpp3WCikYqWaUQL1/jRNjtSk+N7cjBGNKzqFSgTyQ5V4Cm48oOaxHCSi5I7UjVe X-Received: by 2002:a05:6402:549:: with SMTP id i9mr32179637edx.379.1615832945679; Mon, 15 Mar 2021 11:29:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615832945; cv=none; d=google.com; s=arc-20160816; b=0ZTKeCzw7lVIFGsCNc+L7pID+b+Np/K+At95nmu2U1nLjEQtUxV0XADmcYxunOv7xR vjPNJQacM5m06dVkEtXtaj2W5vFqvhMng9VxUtajgMjQBdxZkGEjp/pjZeo6QHrUU7Lr G3B1oKUjZnARyjhnSNW/4WmTFAggI/SjQDCDFeew4M6k8XlqIm9wtVWaJskmC6vOlL2T r6+UfeqfEzswi5b+RoSVVIMgRKDrDZUMvxqjlBHBCiIbgZIZhEjTuy47j59tWl0va72M VgfjtT4MK4vZKaGRUDB/fNmceWJ7mbKkkG/9uT3iMCEwWwA0ZPeozu7ukC08OegeCt4k jyrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=BoSHqwJUq+ZhO6moZvCpdJHz7N1h1/QVCBg9FhFlIwo=; b=iBLa+cumfGfVBrFkD5M5qUz2R/LKaLZRiayilvs88g1R+AbZUDhkdkV8HSgL1EaD8n T6FPrWOPJXSSsfflR6OdujPiPuPeo3dgwracpfOhm9Vo+iQI10TU+zVU1EBLsCuBVC4i 02vIvWAB37bBhu1utcdmdYNcnAHLH7EbITTpxlVGEczcZWk2TiwX6Rg9ihFHdoxbCXhB XTLSn/te58r5pdEdCCbnXN/Tn7kJ3+oYu9CPbW2Z2VZNZG7FwSJvKpKuH0CJk/IjMTdj weF6ACpOphjfQc9KW2DKPqv7eDC2CC5nd0/63eRw6vHCDkX//wnrUHvNABs9og21wHfR 51oA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Pskd2nAI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id m18si11922566edv.199.2021.03.15.11.28.38; Mon, 15 Mar 2021 11:29:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Pskd2nAI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239811AbhCOOdI (ORCPT + 99 others); Mon, 15 Mar 2021 10:33:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:37632 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233254AbhCOOBO (ORCPT ); Mon, 15 Mar 2021 10:01:14 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id CC6AF64F3E; Mon, 15 Mar 2021 14:00:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816853; bh=pR1pufmG/MhLNeDLkodBt1al3UflGQbFvsUbvmTlshA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pskd2nAIZDhBlXuBx8xZfLUqyhYfTbXZEiIE6k+rMDb5FcyJUtpMCV8FlZIZfHLDj XgzKy2Ay/vn9DBc9JEsl8ELQH9o/thEMF8fyKS6y3sFfG6ZQSVnQt8jfeSx82jNiTL tvfkzI1v1TcRN1RXaLPctGJogQMJQcSUtDGhAjQI= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roman Bolshakov , Bodo Stroesser , Aleksandr Miloserdov , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.11 162/306] scsi: target: core: Prevent underflow for service actions Date: Mon, 15 Mar 2021 14:53:45 +0100 Message-Id: <20210315135513.112271716@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135507.611436477@linuxfoundation.org> References: <20210315135507.611436477@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Aleksandr Miloserdov [ Upstream commit 14d24e2cc77411301e906a8cf41884739de192de ] TCM buffer length doesn't necessarily equal 8 + ADDITIONAL LENGTH which might be considered an underflow in case of Data-In size being greater than 8 + ADDITIONAL LENGTH. So truncate buffer length to prevent underflow. Link: https://lore.kernel.org/r/20210209072202.41154-3-a.miloserdov@yadro.com Reviewed-by: Roman Bolshakov Reviewed-by: Bodo Stroesser Signed-off-by: Aleksandr Miloserdov Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/target/target_core_pr.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 14db5e568f22..d4cc43afe05b 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -3739,6 +3739,7 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd) spin_unlock(&dev->t10_pr.registration_lock); put_unaligned_be32(add_len, &buf[4]); + target_set_cmd_data_length(cmd, 8 + add_len); transport_kunmap_data_sg(cmd); @@ -3757,7 +3758,7 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) struct t10_pr_registration *pr_reg; unsigned char *buf; u64 pr_res_key; - u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */ + u32 add_len = 0; if (cmd->data_length < 8) { pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u" @@ -3775,8 +3776,9 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) pr_reg = dev->dev_pr_res_holder; if (pr_reg) { /* - * Set the hardcoded Additional Length + * Set the Additional Length to 16 when a reservation is held */ + add_len = 16; put_unaligned_be32(add_len, &buf[4]); if (cmd->data_length < 22) @@ -3812,6 +3814,8 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd) (pr_reg->pr_res_type & 0x0f); } + target_set_cmd_data_length(cmd, 8 + add_len); + err: spin_unlock(&dev->dev_reservation_lock); transport_kunmap_data_sg(cmd); @@ -3830,7 +3834,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) struct se_device *dev = cmd->se_dev; struct t10_reservation *pr_tmpl = &dev->t10_pr; unsigned char *buf; - u16 add_len = 8; /* Hardcoded to 8. */ + u16 len = 8; /* Hardcoded to 8. */ if (cmd->data_length < 6) { pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:" @@ -3842,7 +3846,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) if (!buf) return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - put_unaligned_be16(add_len, &buf[0]); + put_unaligned_be16(len, &buf[0]); buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */ buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */ buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */ @@ -3871,6 +3875,8 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd) buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */ buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */ + target_set_cmd_data_length(cmd, len); + transport_kunmap_data_sg(cmd); return 0; @@ -4031,6 +4037,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd) * Set ADDITIONAL_LENGTH */ put_unaligned_be32(add_len, &buf[4]); + target_set_cmd_data_length(cmd, 8 + add_len); transport_kunmap_data_sg(cmd); -- 2.30.1