To:     Kees Cook <keescook@chromium.org>
Cc:     Bart Van Assche <bvanassche@acm.org>,
        Hannes Reinecke <hare@suse.de>,
        Himanshu Madhani <himanshu.madhani@oracle.com>,
        Adaptec OEM Raid Solutions <aacraid@microsemi.com>,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        linux-scsi@vger.kernel.org, stable@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH] scsi: aacraid: Allocate cmd_priv with scsicmd
From:   "Martin K. Petersen" <martin.petersen@oracle.com>
Organization: Oracle Corporation
Message-ID: <yq1mt5nzr2e.fsf@ca-mkp.ca.oracle.com>
References: <20230128000409.never.976-kees@kernel.org>
Date:   Wed, 08 Feb 2023 18:16:17 -0500
In-Reply-To: <20230128000409.never.976-kees@kernel.org> (Kees Cook's message
        of "Fri, 27 Jan 2023 16:04:13 -0800")
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2cUKNmARrAzk4etnwkaQgWOTiNcDQ+ngIFVQl/th8Buc+dbzCjteZOi/SnWS?=
 =?us-ascii?Q?/uWEo9Kx6jwfoaYK3+HGWzPXxhPvqUQ4KJtBauq4Mtkg1C7AGPQ1KQ9mP8zN?=
 =?us-ascii?Q?6QhMUmiEWtmdgSN5jgJ0apOClq9pmhVAhUFMbp1Hq0Z/i2jR8gs/1VcA44GJ?=
 =?us-ascii?Q?EIGxCvkpnm7pCsWa308Hs6xt21k/c5gRoOrn2D+cIjZgrRk60aYf6kmArvYo?=
 =?us-ascii?Q?m7VvVNBKSIZK6ybrR4y2IoEyaBKATavN8cezclMUnaRNx8EvWmEERM1NRV0R?=
 =?us-ascii?Q?5EPuIGmwD3Z1ehJYQQmTG/1ooMwPJMrup/lyMnkrS2I2hpaDLTCPAF99CdSb?=
 =?us-ascii?Q?idUv8wo+O8eCcoR5MEokPJTXL5NF3eI+ll77bBMKMhD9opVDCTV9PsvZAihG?=
 =?us-ascii?Q?TcU+O35FWT+ZLxAwsZyZuvKX0sWBLGRWahHI1PzuVxOvnEIhzP88L4gldkix?=
 =?us-ascii?Q?KnB3vSXFaN47m3glrtVsLWnlx4HnZuggTASRuEFmhXlMJiH7mSIV57olEy6v?=
 =?us-ascii?Q?fP9wtRu1z60tGcjPRoh7MQOUQl7YReNDj5qhPups2CZjPlpWPaPoXB6EzRCK?=
 =?us-ascii?Q?+0/nPpjKZqnA02TAmfeIPXAnP8VhqONoAWlQonCeLVeh76UKGCX0afz98Mb+?=
 =?us-ascii?Q?Uq+9LgWBE+QkpxppIbh9iq5KQQWJ38Pcu/yydV/lHhreMi3Prhw+9w3k5RjF?=
 =?us-ascii?Q?pSZOhU0VD33+MmXExOH/72ntm1K5Gbn+p9hGzQj3I5c2Avi1yOp9c+FUk66d?=
 =?us-ascii?Q?C5xYkUQ8JoVD6SEe5saLf25rKl+H+d+6z0DwfT16Uo8zHkWp1JPtJ3kBOX4F?=
 =?us-ascii?Q?IfEChacLiUTCbALjy/3kDPbM//SmKh0e7BCIn3MdZ4uuTpXXXw/kokrjbH0L?=
 =?us-ascii?Q?/YJKjZSrFNF5oIEAhrwo1w8tqog8JtlyxJti+6NkzHL4tM1nop+SG/xmeHsP?=
 =?us-ascii?Q?6EkcPlCTwJU0Q5ay/VVWgVAcyRaO9QXNwnmang3EFtn+dmxNfbZ8pnKO3NYa?=
 =?us-ascii?Q?hc7Sj/7AiwVS7toYe8xQTl6OrofBDEbfjMi84ek6qUA/QHdO0LI8oG3JdAKQ?=
 =?us-ascii?Q?MLX41pMsEjmJGjle/wJS7mtmH98i2QE/YYMzyOQTFviJ+CbmPjNm/sKzC8SC?=
 =?us-ascii?Q?72TRNml4Utm2FoNX/k5IDXbHSi1xonY2VTDxtt0foOhxXIFk8wbk5UPnXs/m?=
 =?us-ascii?Q?uiZ3YpUKgpyifM/kLULoUe+dqiImWZZfHIWf7IKHDFCH4TcSBNmGpJYOlkFB?=
 =?us-ascii?Q?JsuoKmHcgjQDIH0TY1pWKAUwtnA9wB7mg+SGhb0famgT/P9kZMm4wPYXMzGl?=
 =?us-ascii?Q?mWh+cgCyzeUssgv2RDFpIEY7KG/1hGadpfyuAVNBIF14E4UfjfE8Qkq6vhH5?=
 =?us-ascii?Q?JtjfA2XwDDPLLB/zl9FIm6sAfQBuhWU2zheJ0yRgjjGActvv8IA8rcx2V4Md?=
 =?us-ascii?Q?7Vwb5LaCdmH90JlsNTO6lrZ3Et5tOGe5zl8AOTdasn7Fs/JDxmkBEVclACKO?=
 =?us-ascii?Q?OlO4397kkhEq1ACSVshbCpGwx0W3qThZRhpbQ2eoNsWpEOv+Q5/7eFN9Sjgp?=
 =?us-ascii?Q?wD+FhKzonOUqWv7HvxD1phKqjfhY2RxPf77rk8+DQtLNy9H6QQam1nAfMXXC?=
 =?us-ascii?Q?Fw=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: K+oDzd/8Lq1B6yBe+IX1WMtlDqjj3NyNAqGnIu03qbjv07YfxrtIcb1qdxGPXO2keFmPm1bhdtK6iylHPCCjsdGlcbR67bRv+1Vbw7ZhKPXAlr1Cmy5/ROavFbyOZjZ/eabXj6v8u5JNl3rl0pqXbLPZTjxq8DkVtA7RgMyvLEUS67SAHxnP/aOSOcSudVSPs1KFnA0V/zBVGt+ZOvNjs5fDra/m6/UeblcLJB/Tm7ZTSZpOUDrwNxtdU80TVFj9jrK+lnECs7VXoJg9YXw0/g3szapkgCKzc3UEQeqXA0oml8LcagHNvjFq+VN8CmkUiDuosD6P0TOI3SHstZ1MsOt3jemmkdhL/ZCEhZo5OGTHzFZQkWWCGqFGypSG6+rD6J/WOPl/4bB7IfqbrINw9kJfurN7SCFtfL135X2XQl4m2x9VzfAYTQ9KsZkWNJVGUqOzi/y3mW6GpcQ9K1vaq79TeRru3xH5w/1cq7uRmWNbKA4DI1AdjzcdVqqWRyO+KlNRyi8C1nU3kU6V/Ir1fcrsOOiET8H562tu0npnwPiMd8fgBUTi6BfZ9dPLyQ6BUg+TQgsHXOkjMrgLno3DXG5jMJMsKrJdkQ/Bht3FRZglG+5YlNUSRuZZWn/mzsvDfehxkXZ9mLq0c1FW6f/Hg1bkZtLcCUYRwzrGvwSxhwxPH8tCYBYXfgLeBwL3kyOtk6so/QWQwraL7mVAr05zo1AqWwiLUyyRSdHzWQmpJXWQBDgRt1k1fRyjD2PYwlhW8Yb27Nm/bnVHJ9F76yHdDtsQujioCtcveCV0ELRZwB/eQZopCCKgpDPrZhgSrZueB2GPaW40xGFrNxoLEvISg+nDGIQl9SiFxc8Y/MOFFvu199iUv1OLvXnXeyM4K5/ey/8Q/d5uP5aRFgsk1elS319O9jnB87IWBWBmCnEWkx4=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5a2e17b5-5edf-436c-0fad-08db0a2a7cb8
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Feb 2023 23:16:20.2273
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: cEPcdUchI4aEJ0+s/inM2ZtgX/9wbGkzHTGVOfnFtFy5V80unVbYEmYwUwmgoUqHB5zFf1gx7/WGF418IKKT2TczIW4Ml3qwIC3WyDKxiv0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4735
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.122.1
 definitions=2023-02-08_09,2023-02-08_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0 adultscore=0
 malwarescore=0 mlxscore=0 phishscore=0 spamscore=0 mlxlogscore=646
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000
 definitions=main-2302080197
X-Proofpoint-GUID: WwyMOThfVaHuPXsmrSK_nd5T_oC13cTx
X-Proofpoint-ORIG-GUID: WwyMOThfVaHuPXsmrSK_nd5T_oC13cTx
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


Kees,

> The aac_priv() helper assumes that the private cmd area immediately
> follows struct scsi_cmnd. Allocate this space as part of scsicmd, else
> there is a risk of heap overflow. Seen with GCC 13:

Applied to 6.3/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering