Commit 801ab13d authored by Tomas Henzl's avatar Tomas Henzl Committed by Martin K. Petersen
Browse files

scsi: ses: Fix possible desc_ptr out-of-bounds accesses 

Sanitize possible desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().

Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com


Cc: stable@vger.kernel.org
Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent db95d4df

drivers/scsi/ses.c

+9 −5
Original line number Diff line number Diff line
@@ -578,17 +578,21 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, 
			int max_desc_len;



			if (desc_ptr) {

				if (desc_ptr >= buf + page7_len) {

				if (desc_ptr + 3 >= buf + page7_len) {

					desc_ptr = NULL;

				} else {

					len = (desc_ptr[2] << 8) + desc_ptr[3];

					desc_ptr += 4;

					if (desc_ptr + len > buf + page7_len)

						desc_ptr = NULL;

					else {

						/* Add trailing zero - pushes into

						 * reserved space */

						desc_ptr[len] = '\0';

						name = desc_ptr;

					}

				}

			}

			if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||

			    type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) {