Re: [patch] [SCSI] qla4xxx: overflow in qla4xxx_set_chap_entry()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




-----Original Message-----
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Wednesday, 13 November 2013 1:18 pm
To: Vikas <vikas.chaudhary@xxxxxxxxxx>, Adheer Chandravanshi
<adheer.chandravanshi@xxxxxxxxxx>
Cc: Dept-Eng iSCSI Driver <Dept-iSCSIDriver@xxxxxxxxxx>, "James E.J.
Bottomley" <JBottomley@xxxxxxxxxxxxx>, scsi <linux-scsi@xxxxxxxxxxxxxxx>,
"kernel-janitors@xxxxxxxxxxxxxxx" <kernel-janitors@xxxxxxxxxxxxxxx>
Subject: [patch] [SCSI] qla4xxx: overflow in qla4xxx_set_chap_entry()

>We should cap the size of memcpy() because it comes from the network
>and can't be trusted.

This patch is on assumption that data is coming from network,
but in this case data come from application (iscsiadm) with correct length.


>
>Fixes: 26ffd7b45fe9 ('[SCSI] qla4xxx: Add support to set CHAP entries')
>Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>
>diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
>index a28d5e6..cf174a4 100644
>--- a/drivers/scsi/qla4xxx/ql4_os.c
>+++ b/drivers/scsi/qla4xxx/ql4_os.c
>@@ -802,6 +802,7 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host
>*shost, void *data, int len)
> 	int type;
> 	int rem = len;
> 	int rc = 0;
>+	int size;
> 
> 	memset(&chap_rec, 0, sizeof(chap_rec));
> 
>@@ -816,12 +817,14 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host
>*shost, void *data, int len)
> 			chap_rec.chap_type = param_info->value[0];
> 			break;
> 		case ISCSI_CHAP_PARAM_USERNAME:
>-			memcpy(chap_rec.username, param_info->value,
>-			       param_info->len);
>+			size = min_t(size_t, sizeof(chap_rec.username),
>+				     param_info->len);
>+			memcpy(chap_rec.username, param_info->value, size);
> 			break;
> 		case ISCSI_CHAP_PARAM_PASSWORD:
>-			memcpy(chap_rec.password, param_info->value,
>-			       param_info->len);
>+			size = min_t(size_t, sizeof(chap_rec.password),
>+				     param_info->len);
>+			memcpy(chap_rec.password, param_info->value, size);
> 			break;
> 		case ISCSI_CHAP_PARAM_PASSWORD_LEN:
> 			chap_rec.password_length = param_info->value[0];

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux