"len" has to be at least 12 because we need that space for the overall
descriptor, otherwise we end up reading beyond the end of the array and
KASan complains. Later on we have some more range checking on desc_ptr
but we are checking the start of the "desc_ptr" buffer instead of the
end of the buffer (desc_ptr + 4). Let's tighten that up as well.
Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@xxxxxxxxxxxxxxx>
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index dcb0d76..ff474c7 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -476,6 +476,8 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
goto simple_populate;
page7_len = len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
+ if (len < 12)
+ goto simple_populate;
/* add 1 for trailing '\0' we'll use */
buf = kzalloc(len + 1, GFP_KERNEL);
if (!buf)
@@ -504,15 +506,19 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
struct enclosure_component *ecomp;
if (desc_ptr) {
- if (desc_ptr >= buf + page7_len) {
+ if (desc_ptr + 4 >= buf + page7_len) {
desc_ptr = NULL;
} else {
len = (desc_ptr[2] << 8) + desc_ptr[3];
desc_ptr += 4;
/* Add trailing zero - pushes into
* reserved space */
- desc_ptr[len] = '\0';
- name = desc_ptr;
+ if (desc_ptr + len >= buf + page7_len) {
+ desc_ptr = NULL;
+ } else {
+ desc_ptr[len] = '\0';
+ name = desc_ptr;
+ }
}
}
if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
