[PATCH 02/17] mpi3mr: Fix out-of-bounds read when copying BSG MPI requests
Chandrakanth Patil <[email protected]>
| Newsgroups | org.kernel.vger.linux-scsi |
|---|---|
| Message-ID | <[email protected]> |
The MPI request is copied out of the caller supplied payload without
first checking that the requested amount is actually present, so the
copy can read past the end of the payload buffer.
Check the range before copying.
Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands")
Signed-off-by: Chandrakanth Patil <[email protected]>
---
drivers/scsi/mpi3mr/mpi3mr_app.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index 8e5d24793efd..1cd1c38dcd56 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -2538,6 +2538,14 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
rval = -EINVAL;
goto out;
}
+ if (sgl_iter + mpi_msg_size >
+ dout_buf + job->request_payload.payload_len) {
+ dprint_bsg_err(mrioc, "%s: MPI request buf exceeds dout_buf\n",
+ __func__);
+ mutex_unlock(&mrioc->bsg_cmds.mutex);
+ rval = -EINVAL;
+ goto out;
+ }
memcpy(mpi_req, sgl_iter, mpi_msg_size);
break;
default: