mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 16:01:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd()

Browse Source 
The bounds checking in scsi_bsg_uring_cmd() does not work because
cmd->request_len is a u32 and scmd->cmd_len is a u16.  We check that
scmd->cmd_len is valid but if the cmd->request_len is more than
USHRT_MAX it would still lead to a buffer overflow when we do the
copy_from_user().

Fixes: 7b6d3255e7 ("scsi: bsg: add io_uring passthrough handler")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/adjNnMYK7A7KMNkA@stanley.mountain
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Dan Carpenter
2026-04-10 13:14:52 +03:00
committed by Jens Axboe
parent 539fb773a3
commit 0a42ca4d2b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/scsi/scsi_bsg.c
View File

@@ -137,11 +137,11 @@ static int scsi_bsg_uring_cmd(struct request_queue *q, struct io_uring_cmd *iouc
return PTR_ERR(req);
scmd = blk_mq_rq_to_pdu(req);
scmd->cmd_len = cmd->request_len;
if (scmd->cmd_len > sizeof(scmd->cmnd)) {
if (cmd->request_len > sizeof(scmd->cmnd)) {
ret = -EINVAL;
goto out_free_req;
}
scmd->cmd_len = cmd->request_len;
scmd->allowed = SG_DEFAULT_RETRIES;
if (copy_from_user(scmd->cmnd, uptr64(cmd->request), cmd->request_len)) {