From: Zhu Wei <zhuwei@xxxxxxxxxxxxxx>
A fix for:
BUG: KASAN: slab-out-of-bounds in ses_get_power_status+0x178/0x1a8 [ses]
Read of size 1 at addr ffffa5e3f9466a2b by task grep/102588
Call trace:
ses_get_power_status+0x178/0x1a8 [ses]
get_component_power_status+0x94/0x1f0 [enclosure]
dev_attr_show+0x5c/0xc8
sysfs_kf_seq_show+0x1b0/0x350
kernfs_seq_show+0x10c/0x160
seq_read+0x250/0xe28
If the page2 buffer is less than the number of elements indicated by page1,
that will cause desc_ptr to point to out-of-bounds.
The report occurs when we read sg power_status which iscsi target is a Dell
PowerVault MD3200i storage server.
Signed-off-by: Zhu Wei <zhuwei@xxxxxxxxxxxxxx>
Signed-off-by: Ding Hui <dinghui@xxxxxxxxxxxxxx>
---
drivers/scsi/ses.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index d7d0c35c58b8..2a404e51b6db 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -165,6 +165,8 @@ static int ses_set_page2_descriptor(struct enclosure_device *edev,
for (i = 0; i < ses_dev->page1_num_types; i++, type_ptr += 4) {
for (j = 0; j < type_ptr[1]; j++) {
desc_ptr += 4;
+ if (desc_ptr - ses_dev->page2 + 4 > ses_dev->page2_len)
+ break;
if (type_ptr[0] != ENCLOSURE_COMPONENT_DEVICE &&
type_ptr[0] != ENCLOSURE_COMPONENT_ARRAY_DEVICE)
continue;
@@ -196,6 +198,8 @@ static unsigned char *ses_get_page2_descriptor(struct enclosure_device *edev,
for (i = 0; i < ses_dev->page1_num_types; i++, type_ptr += 4) {
for (j = 0; j < type_ptr[1]; j++) {
desc_ptr += 4;
+ if (desc_ptr - ses_dev->page2 + 4 > ses_dev->page2_len)
+ return NULL;
if (type_ptr[0] != ENCLOSURE_COMPONENT_DEVICE &&
type_ptr[0] != ENCLOSURE_COMPONENT_ARRAY_DEVICE)
continue;
--
2.17.1
