Re: [PATCH next] scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd()
Jens Axboe <[email protected]>
| Newsgroups | org.kernel.vger.kernel-janitors,org.kernel.vger.linux-kernel,org.kernel.vger.linux-scsi |
|---|---|
| Message-ID | <177582490925.498357.11572099652786235764.b4-ty@b4> |
On Fri, 10 Apr 2026 13:14:52 +0300, Dan Carpenter wrote:
> The bounds checking in scsi_bsg_uring_cmd() does not work because
> cmd->request_len is a u32 and scmd->cmd_len is a u16. We check that
> scmd->cmd_len is valid but if the cmd->request_len is more than
> USHRT_MAX it would still lead to a buffer overflow when we do the
> copy_from_user().
>
>
> [...]
Applied, thanks!
[1/1] scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd()
commit: 0a42ca4d2bff6306dd574a7897258fd02c2e6930
Best regards,
--
Jens Axboe