Commit d3d9c457 authored by Bart Van Assche's avatar Bart Van Assche Committed by Martin K. Petersen
Browse files

scsi: ufs: Fix memory corruption by ufshcd_read_desc_param() 

If param_offset > buff_len then the memcpy() statement in
ufshcd_read_desc_param() corrupts memory since it copies 256 + buff_len -
param_offset bytes into a buffer with size buff_len.  Since param_offset <
256 this results in writing past the bound of the output buffer.

Link: https://lore.kernel.org/r/20210722033439.26550-2-bvanassche@acm.org


Fixes: cbe193f6 ("scsi: ufs: Fix potential NULL pointer access during memcpy")
Reviewed-by: default avatarAvri Altman <avri.altman@wdc.com>
Reviewed-by: default avatarDaejun Park <daejun7.park@samsung.com>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent f95f59a2

drivers/scsi/ufs/ufshcd.c

+5 −3
Original line number Diff line number Diff line
@@ -3426,9 +3426,11 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, 


	if (is_kmalloc) {

		/* Make sure we don't copy more data than available */

		if (param_offset + param_size > buff_len)

			param_size = buff_len - param_offset;

		memcpy(param_read_buf, &desc_buf[param_offset], param_size);

		if (param_offset >= buff_len)

			ret = -EINVAL;

		else

			memcpy(param_read_buf, &desc_buf[param_offset],

			       min_t(u32, param_size, buff_len - param_offset));

	}

out:

	if (is_kmalloc)