Commit 86a6a0bd authored by Kees Cook's avatar Kees Cook Committed by Martin K. Petersen
Browse files

scsi: arcmsr: Avoid over-read of sense buffer 

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

pcmd->sense_buffer is 96 bytes, and was being manually zero-filled.
However, struct SENSE_DATA is 18 bytes, with ccb->arcmsr_cdb.SenseData only
being 15 bytes, resulting in a 3 byte over-read.

Copy only the contents of ccb->arcmsr_cdb.SenseData and zero fill the
remainder, avoiding potential over-reads.

Link: https://lore.kernel.org/r/20210616212428.1726958-1-keescook@chromium.org


Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 4ab293c2

drivers/scsi/arcmsr/arcmsr_hba.c

+11 −8
Original line number Diff line number Diff line
@@ -1323,16 +1323,19 @@ static void arcmsr_ccb_complete(struct CommandControlBlock *ccb) 


static void arcmsr_report_sense_info(struct CommandControlBlock *ccb)

{



	struct scsi_cmnd *pcmd = ccb->pcmd;

	struct SENSE_DATA *sensebuffer = (struct SENSE_DATA *)pcmd->sense_buffer;



	pcmd->result = (DID_OK << 16) | SAM_STAT_CHECK_CONDITION;

	if (sensebuffer) {

		int sense_data_length =

			sizeof(struct SENSE_DATA) < SCSI_SENSE_BUFFERSIZE

			? sizeof(struct SENSE_DATA) : SCSI_SENSE_BUFFERSIZE;

		memset(sensebuffer, 0, SCSI_SENSE_BUFFERSIZE);

		memcpy(sensebuffer, ccb->arcmsr_cdb.SenseData, sense_data_length);

	if (pcmd->sense_buffer) {

		struct SENSE_DATA *sensebuffer;



		memcpy_and_pad(pcmd->sense_buffer,

			       SCSI_SENSE_BUFFERSIZE,

			       ccb->arcmsr_cdb.SenseData,

			       sizeof(ccb->arcmsr_cdb.SenseData),

			       0);



		sensebuffer = (struct SENSE_DATA *)pcmd->sense_buffer;

		sensebuffer->ErrorCode = SCSI_SENSE_CURRENT_ERRORS;

		sensebuffer->Valid = 1;

	}