This is a note to let you know that I've just added the patch titled
scsi: aacraid: Allocate cmd_priv with scsicmd
to the 6.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scsi-aacraid-allocate-cmd_priv-with-scsicmd.patch
and it can be found in the queue-6.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 7ab734fc759828707dae22fe48b1eb4dcf70beea Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@xxxxxxxxxxxx>
Date: Fri, 27 Jan 2023 16:04:13 -0800
Subject: scsi: aacraid: Allocate cmd_priv with scsicmd
From: Kees Cook <keescook@xxxxxxxxxxxx>
commit 7ab734fc759828707dae22fe48b1eb4dcf70beea upstream.
The aac_priv() helper assumes that the private cmd area immediately follows
struct scsi_cmnd. Allocate this space as part of scsicmd, else there is a
risk of heap overflow. Seen with GCC 13:
../drivers/scsi/aacraid/aachba.c: In function 'aac_probe_container':
../drivers/scsi/aacraid/aachba.c:841:26: warning: array subscript 16 is outside array bounds of 'void[392]' [-Warray-bounds=]
841 | status = cmd_priv->status;
| ^~
In file included from ../include/linux/resource_ext.h:11,
from ../include/linux/pci.h:40,
from ../drivers/scsi/aacraid/aachba.c:22:
In function 'kmalloc',
inlined from 'kzalloc' at ../include/linux/slab.h:720:9,
inlined from 'aac_probe_container' at ../drivers/scsi/aacraid/aachba.c:821:30:
../include/linux/slab.h:580:24: note: at offset 392 into object of size 392 allocated by 'kmalloc_trace'
580 | return kmalloc_trace(
| ^~~~~~~~~~~~~~
581 | kmalloc_caches[kmalloc_type(flags)][index],
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
582 | flags, size);
| ~~~~~~~~~~~~
Fixes: 76a3451b64c6 ("scsi: aacraid: Move the SCSI pointer to private command data")
Link: https://lore.kernel.org/r/20230128000409.never.976-kees@xxxxxxxxxx
Cc: Bart Van Assche <bvanassche@xxxxxxx>
Cc: Hannes Reinecke <hare@xxxxxxx>
Cc: Himanshu Madhani <himanshu.madhani@xxxxxxxxxx>
Cc: Adaptec OEM Raid Solutions <aacraid@xxxxxxxxxxxxx>
Cc: "James E.J. Bottomley" <jejb@xxxxxxxxxxxxx>
Cc: "Martin K. Petersen" <martin.petersen@xxxxxxxxxx>
Cc: linux-scsi@xxxxxxxxxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Reviewed-by: Vegard Nossum <vegard.nossum@xxxxxxxxxx>
Reviewed-by: Hannes Reinecke <hare@xxxxxxx>
Reviewed-by: Bart Van Assche <bvanassche@xxxxxxx>
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/scsi/aacraid/aachba.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -818,8 +818,8 @@ static void aac_probe_container_scsi_don
int aac_probe_container(struct aac_dev *dev, int cid)
{
- struct scsi_cmnd *scsicmd = kzalloc(sizeof(*scsicmd), GFP_KERNEL);
- struct aac_cmd_priv *cmd_priv = aac_priv(scsicmd);
+ struct aac_cmd_priv *cmd_priv;
+ struct scsi_cmnd *scsicmd = kzalloc(sizeof(*scsicmd) + sizeof(*cmd_priv), GFP_KERNEL);
struct scsi_device *scsidev = kzalloc(sizeof(*scsidev), GFP_KERNEL);
int status;
@@ -838,6 +838,7 @@ int aac_probe_container(struct aac_dev *
while (scsicmd->device == scsidev)
schedule();
kfree(scsidev);
+ cmd_priv = aac_priv(scsicmd);
status = cmd_priv->status;
kfree(scsicmd);
return status;
Patches currently in stable-queue which might be from keescook@xxxxxxxxxxxx are
queue-6.2/sysctl-fix-proc_dobool-usability.patch
queue-6.2/coda-avoid-partial-allocation-of-sig_inputargs.patch
queue-6.2/bluetooth-hci_conn-refactor-hci_bind_bis-since-it-al.patch
queue-6.2/panic-fix-the-panic_print-nmi-backtrace-setting.patch
queue-6.2/regulator-s5m8767-bounds-check-id-indexing-into-arra.patch
queue-6.2/gcc-plugins-drop-std-gnu-11-to-fix-gcc-13-build.patch
queue-6.2/dmaengine-dw-axi-dmac-do-not-dereference-null-struct.patch
queue-6.2/asoc-kirkwood-iterate-over-array-indexes-instead-of-.patch
queue-6.2/fs-use-check_data_corruption-when-kernel-bugs-are-de.patch
queue-6.2/crypto-hisilicon-wipe-entire-pool-on-error.patch
queue-6.2/regulator-max77802-bounds-check-regulator-id-against.patch
queue-6.2/io_uring-replace-0-length-array-with-flexible-array.patch
queue-6.2/uaccess-add-minimum-bounds-check-on-kernel-buffer-si.patch
queue-6.2/thermal-drivers-hisi-drop-second-sensor-hi3660.patch
queue-6.2/scm-add-user-copy-checks-to-put_cmsg.patch
queue-6.2/drm-nouveau-disp-fix-nvif_outp_acquire_dp-argument-s.patch
queue-6.2/net-mlx4_en-introduce-flexible-array-to-silence-over.patch
queue-6.2/scsi-aacraid-allocate-cmd_priv-with-scsicmd.patch
