From patchwork Sun Jul 23 08:00:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lin Ma X-Patchwork-Id: 124431 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9010:0:b0:3e4:2afc:c1 with SMTP id l16csp1161277vqg; Sun, 23 Jul 2023 01:32:06 -0700 (PDT) X-Google-Smtp-Source: APBJJlFvEF2WMcLz/pAXvE+ss5Bw65xMPgLrmgHFCdtNp3qvTRLTU8gD2jh8dp6Eg3cLX/Q7eJrz X-Received: by 2002:a17:902:7fcd:b0:1b7:f64b:378a with SMTP id t13-20020a1709027fcd00b001b7f64b378amr5071810plb.16.1690101125913; Sun, 23 Jul 2023 01:32:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690101125; cv=none; d=google.com; s=arc-20160816; b=fjbvy0kv0JL0NCGop5DRU/KZQjG2Cozg5RcOpyQKlvAw6kACgjvebzFJEOXXMJW85Z 0GQfbTRMFqiLtMwKObY0KHK18J+wcsnA2B6mh30isg6uVeoaf+PYQrYCcjpOC5O9EHoq u/Ker/QTMG3Fe31S7nxHb/gwFxPavnSX4SpnJq9VtGQJJ1UHqcfprQASDb0QSpG7r/5g sX+JBUW4wNRZFRFx0FG8FTvuq4BQG1qKos/ecNpO0FsfGfHsVLJEtmszGPJZNH1Qw6Vf 3ebcavSSwxWCwUywxO/BMoHA/WVFQEo2H8z0eCgPCxNKjTiel4Phqr+X1ARHTziPpL7O Bi8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:message-id:date:subject:cc:to:from; bh=F4WTaJBNWVLqxSopdvx3rfPSouBXxbVEBTA7LaYV3UE=; fh=ht0E5JnV2ONealVb9MVAGUZnJyvCDLhQEa8FlO9AnYU=; b=XKZsRWdqbmSqDSErMvI56hChuAb8UeZ6qxhlkNjSMuX2ESWQL/RW7C5L1MuyAFwQOy 2Je3HcQ3uZBJQlf5wzlLCxKpQ810tdl05qjtj6jJcePadsLWHDjElrT5hdcAcRFApByT Q8roSJ+KbI9GzNsQAqlr5FJQotzHm4zHvkErANYFg1T6qR2zcruCh5DY6rptxRAOrgEZ ZHoitKySBZk7uVZrV76oB4yQOLDC3UlL7oS3lHh8uHAZZg8bwQ7yqKEdezyxwptaq193 739TBgSLQ92Rm5EMUlFoPzBe+5DmcQsXV5U7wi9txntRZuyBy+UC/pJ+h8nCzgpIEcMI HwFA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id j8-20020a170903024800b001b9ea0f0e8esi7009794plh.650.2023.07.23.01.31.52; Sun, 23 Jul 2023 01:32:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229853AbjGWIBL (ORCPT + 99 others); Sun, 23 Jul 2023 04:01:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50574 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229452AbjGWIBJ (ORCPT ); Sun, 23 Jul 2023 04:01:09 -0400 Received: from zg8tndyumtaxlji0oc4xnzya.icoremail.net (zg8tndyumtaxlji0oc4xnzya.icoremail.net [46.101.248.176]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 9FCFEB1; Sun, 23 Jul 2023 01:01:07 -0700 (PDT) Received: from localhost.localdomain (unknown [39.174.92.167]) by mail-app3 (Coremail) with SMTP id cC_KCgD3qJ043rxkZHd_Cw--.45492S4; Sun, 23 Jul 2023 16:00:57 +0800 (CST) From: Lin Ma To: njavali@marvell.com, mrangankar@marvell.com, GR-QLogic-Storage-Upstream@marvell.com, jejb@linux.ibm.com, martin.petersen@oracle.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lin Ma Subject: [PATCH v1] scsi: qla4xxx: Add length check when paring nlattrs Date: Sun, 23 Jul 2023 16:00:53 +0800 Message-Id: <20230723080053.3714534-1-linma@zju.edu.cn> X-Mailer: git-send-email 2.17.1 X-CM-TRANSID: cC_KCgD3qJ043rxkZHd_Cw--.45492S4 X-Coremail-Antispam: 1UD129KBjvJXoW7ZF1rAF1UCw4DAr48uFW3Jrb_yoW8tr1Dpa yvga4Ykw4qkw1fAr17Ar48ZwsYkw1xtFWDG3Waq348A3ZxXFWfuFy7GFySvryDAws5Ar1a qrs5tFyFgr9rXFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkm14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gc CE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_JF0_Jw1lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lc2xSY4AK67AK6r43 MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr 0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUtVW8ZwCIc40Y0x0E wIxGrwCI42IY6xIIjxv20xvE14v26r1I6r4UMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWxJV W8Jr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF 0xvEx4A2jsIEc7CjxVAFwI0_Gr1j6F4UJbIYCTnIWIevJa73UjIFyTuYvjfU50PfDUUUU X-CM-SenderInfo: qtrwiiyqvtljo62m3hxhgxhubq/ X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1772199478222847575 X-GMAIL-MSGID: 1772199478222847575 There are three places that qla4xxx looply parses nlattrs * qla4xxx_set_chap_entry(...) * qla4xxx_iface_set_param(...) * qla4xxx_sysfs_ddb_set_param(...) and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated before and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data. This patch adds the nla_len check before accessing the nlattr data and error return EINVAL if the length check fails. Fixes: 26ffd7b45fe9 ("[SCSI] qla4xxx: Add support to set CHAP entries") Fixes: 1e9e2be3ee03 ("[SCSI] qla4xxx: Add flash node mgmt support") Fixes: 00c31889f751 ("[SCSI] qla4xxx: fix data alignment and use nl helpers") Signed-off-by: Lin Ma Reviewed-by: Chris Leech --- drivers/scsi/qla4xxx/ql4_os.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index b2a3988e1e15..675332e49a7b 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -968,6 +968,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len) memset(&chap_rec, 0, sizeof(chap_rec)); nla_for_each_attr(attr, data, len, rem) { + if (nla_len(attr) < sizeof(*param_info)) { + rc = -EINVAL; + goto exit_set_chap; + } + param_info = nla_data(attr); switch (param_info->param) { @@ -2750,6 +2755,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len) } nla_for_each_attr(attr, data, len, rem) { + if (nla_len(attr) < sizeof(*iface_param)) { + rval = -EINVAL; + goto exit_init_fw_cb; + } + iface_param = nla_data(attr); if (iface_param->param_type == ISCSI_NET_PARAM) { @@ -8104,6 +8114,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess, memset((void *)&chap_tbl, 0, sizeof(chap_tbl)); nla_for_each_attr(attr, data, len, rem) { + if (nla_len(attr) < sizeof(*fnode_param)) { + rc = -EINVAL; + goto exit_set_param; + } + fnode_param = nla_data(attr); switch (fnode_param->param) {