Commit 9a5c6ac0 authored by Tomas Henzl's avatar Tomas Henzl Committed by Li Lingfeng
Browse files

scsi: ses: Fix possible desc_ptr out-of-bounds accesses 

stable inclusion
from stable-v5.10.173
commit c315560e3ef77c1d822249f1743e647dc9c9912a
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9K8D1

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.10.191&id=c315560e3ef77c1d822249f1743e647dc9c9912a

----------------------------------------

commit 801ab13d upstream.

Sanitize possible desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().

Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com


Cc: stable@vger.kernel.org
Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 9530f1fc

drivers/scsi/ses.c

+9 −5
Original line number Diff line number Diff line
@@ -569,17 +569,21 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, 
			int max_desc_len;



			if (desc_ptr) {

				if (desc_ptr >= buf + page7_len) {

				if (desc_ptr + 3 >= buf + page7_len) {

					desc_ptr = NULL;

				} else {

					len = (desc_ptr[2] << 8) + desc_ptr[3];

					desc_ptr += 4;

					if (desc_ptr + len > buf + page7_len)

						desc_ptr = NULL;

					else {

						/* Add trailing zero - pushes into

						 * reserved space */

						desc_ptr[len] = '\0';

						name = desc_ptr;

					}

				}

			}

			if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||

			    type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) {