Received-SPF: pass (google.com: domain of linux-kernel+bounces-146348-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
MIME-Version: 1.0
References: <CAEkJfYNguDt47=KnEUX7tLwx_46ggBx3Oh3-3dAcZxqndL_OWQ@mail.gmail.com>
 <48043100-a817-4ca2-a141-60e3ab9cbfef@acm.org>
In-Reply-To: <48043100-a817-4ca2-a141-60e3ab9cbfef@acm.org>
From: Sam Sun <samsun1006219@gmail.com>
Date: Tue, 16 Apr 2024 14:32:12 +0800
Message-ID: <CAEkJfYP1eieCj72nnbWQFOq3PmDi_amtRfrG89kViiQy+bePaA@mail.gmail.com>
Subject: Re: [PATCH] drivers: scsi: fix shift-out-of-bounds in sg_build_indirect
To: Bart Van Assche <bvanassche@acm.org>
Cc: linux-kernel@vger.kernel.org, martin.petersen@oracle.com, 
	linux-scsi@vger.kernel.org, xrivendell7@gmail.com, 
	syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 16, 2024 at 1:26=E2=80=AFAM Bart Van Assche <bvanassche@acm.org=
> wrote:
>
> On 4/14/24 20:14, Sam Sun wrote:
> > -    num =3D scatter_elem_sz;
> > +    num =3D max(scatter_elem_sz, PAGE_SIZE);
>
> Shouldn't the following statements be modified instead of the above
> statement? I think these are the only statements that can cause
> scatter_elem_sz to become smaller than PAGE_SIZE:
>
>         scatter_elem_sz =3D ret_sz;
>         scatter_elem_sz_prev =3D ret_sz;
>

Yes, these statements are the only statements that modify
scatter_elem_sz. However, ret_sz will never be less than PAGE_SIZE,
since it is calculated by 1 << (PAGE_SIZE + order), and order will not
be less than zero. So I think these statements do not need to be
modified.

scatter_elem_sz is also exported to userspace by sysfs interface
(macro module_param_named()), and privileged users could modify it to
any int they want. So I also set the exported type to uint in this
patch. Should I also change the type of scatter_elem_sz and
scatter_elem_sz_prev also to uint?

Best Regards,
Yue