Commit 3d0107a7 authored by Kees Cook's avatar Kees Cook
Browse files

scsi: ibmvscsi: Avoid multi-field memset() overflow by aiming at srp 



In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring fields.

Instead of writing beyond the end of evt_struct->iu.srp.cmd, target the
upper union (evt_struct->iu.srp) instead, as that's what is being wiped.

Cc: Tyrel Datwyler <tyreld@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Link: https://lore.kernel.org/lkml/yq135rzp79c.fsf@ca-mkp.ca.oracle.com


Acked-by: default avatarTyrel Datwyler <tyreld@linux.ibm.com>
Link: https://lore.kernel.org/lkml/6eae8434-e9a7-aa74-628b-b515b3695359@linux.ibm.com
parent e4e737bb

drivers/scsi/ibmvscsi/ibmvscsi.c

+2 −1
Original line number Diff line number Diff line
@@ -1055,8 +1055,9 @@ static int ibmvscsi_queuecommand_lck(struct scsi_cmnd *cmnd, 
		return SCSI_MLQUEUE_HOST_BUSY;



	/* Set up the actual SRP IU */

	BUILD_BUG_ON(sizeof(evt_struct->iu.srp) != SRP_MAX_IU_LEN);

	memset(&evt_struct->iu.srp, 0x00, sizeof(evt_struct->iu.srp));

	srp_cmd = &evt_struct->iu.srp.cmd;

	memset(srp_cmd, 0x00, SRP_MAX_IU_LEN);

	srp_cmd->opcode = SRP_CMD;

	memcpy(srp_cmd->cdb, cmnd->cmnd, sizeof(srp_cmd->cdb));

	int_to_scsilun(lun, &srp_cmd->lun);