Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
To:     George Kennedy <george.kennedy@oracle.com>
Cc:     gregkh@linuxfoundation.org, jejb@linux.ibm.com,
        martin.petersen@oracle.com, linux-scsi@vger.kernel.org,
        linux-kernel@vger.kernel.org, dan.carpenter@oracle.com
Subject: Re: [PATCH v2] scsi: scsi_debug: fix type in min_t to avoid stack OOB
From:   "Martin K. Petersen" <martin.petersen@oracle.com>
Organization: Oracle Corporation
Message-ID: <yq11r3wr8ck.fsf@ca-mkp.ca.oracle.com>
References: <1635861997-987-1-git-send-email-george.kennedy@oracle.com>
Date:   Wed, 03 Nov 2021 21:59:43 -0400
In-Reply-To: <1635861997-987-1-git-send-email-george.kennedy@oracle.com>
        (George Kennedy's message of "Tue, 2 Nov 2021 09:06:37 -0500")
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?xucFCwgWxstGFn95xpX3u+RaJw98VPAg6gXRzcX8oG2yOnt2uXE9ywhZJBBm?=
 =?us-ascii?Q?yZYWDA9VoA04yzCHGw8nmkGygFA+q6LNwzRQpnyLugo6XueZoF7pVCAPrv90?=
 =?us-ascii?Q?Lyy6BX4UXmvLkFRveVRU99dK2VHUCL5D/IS2Io81ajJMqV3lXWtvuCMDPlAw?=
 =?us-ascii?Q?ZeMPreXJGEnfzMFsq1upO1IP9zGlp1c8ojPX612ZLvUhFmjOZZqGVbKNN1nI?=
 =?us-ascii?Q?2T0MBwJnN8J2PTWQN0upVNpWtpPt8U0Xaii6EJz+4en0cudK7wjDiR6iOpPy?=
 =?us-ascii?Q?Q9Zhjy5LyRwpMemIEsLQzotD6jEhs7x8NaBevSVhLsoFWfhTYwa2zjqzktqt?=
 =?us-ascii?Q?a2bABK4aemWjEwSWSdjz2hsH4gvERUbDyAG3zouT6bTAG4sP4gxPZPzXa+NH?=
 =?us-ascii?Q?eaZp3NWAfXmdeOe19srEiHTwi4vSPs2N4I7hrpIr76PZlg5QdJyA9f6el/VG?=
 =?us-ascii?Q?8OdlzIUKmKYrl/szJ3CFpP5a8dRUoLFvaCbiqA9QWhdcMmmxbi1pIv4urfXb?=
 =?us-ascii?Q?aTiklxlSvloM1cyiv03POCZ2lenqO8N3wJM2u3Bwvj78GBaKfg4Ub1JDofKb?=
 =?us-ascii?Q?Ts0NtalKuN81vLu/SUwcO6yBS0QBTbILg7Ur37FzgzFBgb0K932r1zl3QR9o?=
 =?us-ascii?Q?1PYvMzhWQQ6X0IBIQskyHy5xKbs6fqj8raGP/pkO56t8bIivFefLEeep7grW?=
 =?us-ascii?Q?W4fQM1Xzw3Ye/UNh5YeHCShHJi4LgYfLJ4ODKu0P2UZteo0JopSIbtM01ppB?=
 =?us-ascii?Q?vsq5ImOy4TXH3F7v0nz8oQMLhz5HlVq8PjVr0Ng0imLDTjtqVn40FGrV0rQ4?=
 =?us-ascii?Q?/olQNubrgWS4pMqkeDBtqM2Wrt48J2ruFmK/Mu4blFINkCx9criixZGXkvVO?=
 =?us-ascii?Q?Hb2OhkZI7Aeka05JiYWisobZlKJr/Pvaio04xrCuJYHCZfNzGpGtlnWIQBeW?=
 =?us-ascii?Q?hFrlByDciV45nYybzGp0+n2Ig+5Ym0b4h2pVcvyiu6dG1iqtaHv9ze5xn/eb?=
 =?us-ascii?Q?Risvxgswbz97tkot33gKc4uNvHzPzi9SMSGPMbL8hdy1ya1d92Qs6+zrBpIi?=
 =?us-ascii?Q?kftadNxXSELHdi6yVdPhwK+snZ8kmNkSBSl4U8oA/4NK8SR13vqlxLB0xJEq?=
 =?us-ascii?Q?KRzhobsPkX+z231niBt/syVX/hcXhnw4hnKrUgz/YPl6xp4aZP0T+bSW/dKT?=
 =?us-ascii?Q?ML6GZOSafnYzPS33IIqeUwEb3wqEPi073QPOX8WTir7c5k2Ls7g5e9nnEcPb?=
 =?us-ascii?Q?iUSR0AT/gQ0tKlMwAg07t7BfBkFh6So3qbCJ8f66r2iE9tX6toi/sSYhhvZw?=
 =?us-ascii?Q?e+Lj6uKclnkDuGmFS3s57OTUCRtAAIruR663Y3zs0vqNy1fnNk8XCMdCv0iD?=
 =?us-ascii?Q?Pabzujdg0pPcnP9AASpxUiqisQ53u3FKxa0XI38g2krZGwimBKSyEOXyDGl4?=
 =?us-ascii?Q?CdjKpE4v1qPkx6myShc/DMNlxeMj/VtD1RqGOCI2/Ji3MZmwhyHSeaSHAHk5?=
 =?us-ascii?Q?m9MG7OgqKKJ+EuFJZcda+/AkML8O3ko4Ylfk/GKJRdy39fvCpRpVW1xBLRjF?=
 =?us-ascii?Q?05yHL7z/N7n8Uz+Mde+T0squUUVjINsdTIRws3gPpKykjP8Qui5kOy1oqf7U?=
 =?us-ascii?Q?4y4uzOclqVl1DQpXTKW7iJaLkiYCUsDoaK/DazfCUZDzEOgiOBSrU9U8pRHH?=
 =?us-ascii?Q?KQghbQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2be3a8d9-b101-4dfc-4b3e-08d99f36c73f
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2021 01:59:47.1352
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: hBRAkJi+cSwd13qnsTQR8WpYkjzHfXgwidIdTVbOwW1FIzMhPGVFgHL2hC/CGk4IOQV1UTGEoQ6znOowuKZhhAsH5yB+tf8K3CJjF0jkefM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB4438
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10157 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 suspectscore=0
 malwarescore=0 bulkscore=0 spamscore=0 adultscore=0 mlxlogscore=999
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2111040007
X-Proofpoint-ORIG-GUID: 0sPfZtUCT5WLdNCE_S3HZW_x1IqzfhO3
X-Proofpoint-GUID: 0sPfZtUCT5WLdNCE_S3HZW_x1IqzfhO3
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


George,

> Change min_t() to use type "unsigned int" instead of type "int" to
> avoid stack out of bounds. With min_t() type "int" the values get sign
> extended and the larger value gets used causing stack out of bounds.

This needs to be reconciled with the following commits:

f347c26836c2 scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
4e3ace0051e7 scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()

Thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering