George Kennedy
a9078e7914
scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
commit e0a2c28da11e2c2b963fc01d50acbf03045ac732 upstream.
In resp_mode_select() sanity check the block descriptor len to avoid UAF.
BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509
Read of size 1 at addr ffff888026670f50 by task scsicmd/15032
CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Call Trace:
<TASK>
dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107
print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257
kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306
resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509
schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483
scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537
scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521
blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640
__blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325
blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358
__blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762
__blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839
blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891
blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474
blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63
sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837
sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775
sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941
sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166
__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52
do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50
entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113
Link: https://lore.kernel.org/r/1637262208-28850-1-git-send-email-george.kennedy@oracle.com
Reported-by: syzkaller <syzkaller@googlegroups.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-22 09:30:59 +01:00
..
2020-12-30 11:53:02 +01:00
2021-07-25 14:36:16 +02:00
2021-07-25 14:36:16 +02:00
2021-07-20 16:05:39 +02:00
2020-10-14 15:15:35 -07:00
2021-07-20 16:05:58 +02:00
2020-10-23 16:19:02 -07:00
2021-06-16 12:01:36 +02:00
2021-07-20 16:05:41 +02:00
2021-11-18 14:04:18 +01:00
2021-07-20 16:05:41 +02:00
2020-10-16 12:21:15 -07:00
2021-08-26 08:35:37 -04:00
2020-03-11 23:07:59 -04:00
2020-10-14 15:15:35 -07:00
2020-10-23 16:19:02 -07:00
2021-02-07 15:37:14 +01:00
2021-07-25 14:36:16 +02:00
2021-05-14 09:50:27 +02:00
2020-08-23 17:36:59 -05:00
2021-07-25 14:36:16 +02:00
2021-07-25 14:36:16 +02:00
2021-07-25 14:36:16 +02:00
2021-11-26 10:39:08 +01:00
2021-08-26 08:35:36 -04:00
2021-12-01 09:19:04 +01:00
2021-07-25 14:36:16 +02:00
2021-09-18 13:40:14 +02:00
2021-12-14 11:32:40 +01:00
2021-09-18 13:40:14 +02:00
2021-09-18 13:40:14 +02:00
2021-12-14 11:32:38 +01:00
2020-10-23 16:19:02 -07:00
2021-09-18 13:40:14 +02:00
2020-10-07 23:50:03 -04:00
2020-10-23 16:19:02 -07:00
2021-11-26 10:39:21 +01:00
2020-03-25 11:50:48 +01:00
2019-02-25 21:37:25 -05:00
2019-03-02 11:39:54 -08:00
2019-10-23 17:23:44 +02:00
2018-10-17 21:58:51 -04:00
2020-10-23 16:19:02 -07:00
2020-09-25 06:20:43 +02:00
2019-01-08 07:58:37 -05:00
2020-06-09 09:39:13 -07:00
2020-06-09 09:39:13 -07:00
2019-05-21 10:50:45 +02:00
2021-11-26 10:39:10 +01:00
2020-07-08 01:12:53 -04:00
2019-05-21 10:50:45 +02:00
2020-03-26 21:10:53 -04:00
2019-05-21 10:50:45 +02:00
2019-11-12 22:21:34 -05:00
2019-11-12 22:21:35 -05:00
2021-09-18 13:40:35 +02:00
2021-06-03 09:00:43 +02:00
2019-05-21 10:50:45 +02:00
2020-02-24 14:54:25 -05:00
2020-04-01 22:03:04 -04:00
2021-11-18 14:04:15 +01:00
2019-05-24 17:36:45 +02:00
2020-09-01 22:15:47 -04:00
2020-03-11 23:07:59 -04:00
2020-08-23 17:36:59 -05:00
2019-12-19 22:08:51 -05:00
2020-09-02 22:49:07 -04:00
2019-06-18 19:46:18 -04:00
2019-07-30 12:17:28 -04:00
2020-07-08 01:12:44 -04:00
2021-07-14 16:56:40 +02:00
2020-08-23 17:36:59 -05:00
2019-01-08 21:58:35 -05:00
2020-03-17 13:36:10 -04:00
2019-01-08 21:57:42 -05:00
2020-10-07 21:48:28 -04:00
2019-01-08 21:58:35 -05:00
2020-06-09 09:39:13 -07:00
2021-10-27 09:56:56 +02:00
2020-09-02 22:49:06 -04:00
2020-10-29 21:55:21 -04:00
2020-09-02 22:49:06 -04:00
2019-06-05 17:36:37 +02:00
2019-06-05 17:36:37 +02:00
2020-08-23 17:36:59 -05:00
2020-10-07 21:48:28 -04:00
2020-08-06 16:50:07 -07:00
2020-07-15 17:26:58 -04:00
2020-07-24 22:32:00 -04:00
2018-11-06 21:31:28 -05:00
2020-06-02 21:23:47 -04:00
2020-10-13 12:12:44 -07:00
2019-05-30 11:26:37 -07:00
2021-05-14 09:50:27 +02:00
2020-07-24 22:09:55 -04:00
2020-06-09 09:39:13 -07:00
2020-10-02 15:27:08 -07:00
2021-07-20 16:05:41 +02:00
2020-06-09 09:39:13 -07:00
2020-10-02 21:52:53 -04:00
2019-11-12 22:21:34 -05:00
2019-07-17 22:39:27 +09:00
2020-10-14 15:15:35 -07:00
2020-08-23 17:36:59 -05:00
2019-05-21 10:50:45 +02:00
2020-06-09 09:39:13 -07:00
2020-10-02 21:42:22 -04:00
2020-03-11 23:07:56 -04:00
2020-10-23 16:19:02 -07:00
2020-01-02 21:57:44 -05:00
2021-03-25 09:04:09 +01:00
2020-01-02 21:57:44 -05:00
2020-08-23 17:36:59 -05:00
2019-05-24 17:36:45 +02:00
2020-08-23 17:36:59 -05:00
2019-06-20 15:37:02 -04:00
2020-09-15 17:34:18 -04:00
2019-05-24 17:39:02 +02:00
2020-09-09 22:40:41 -04:00
2020-03-11 23:07:56 -04:00
2020-08-23 17:36:59 -05:00
2019-05-30 11:26:38 -07:00
2020-09-09 22:37:48 -04:00
2020-01-15 23:09:11 -05:00
2019-03-19 17:11:37 -04:00
2018-12-18 23:19:21 -05:00
2020-10-14 15:15:35 -07:00
2019-02-13 22:07:03 -05:00
2019-06-05 17:37:17 +02:00
2019-05-24 17:36:45 +02:00
2021-12-22 09:30:59 +01:00
2019-07-30 12:42:55 -04:00
2019-05-21 06:16:21 -04:00
2021-06-18 10:00:05 +02:00
2020-07-08 01:16:23 -04:00
2020-10-14 15:15:35 -07:00
2020-08-23 17:36:59 -05:00
2021-11-18 14:03:37 +01:00
2020-07-24 22:09:57 -04:00
2019-12-19 22:08:54 -05:00
2019-05-30 11:26:35 -07:00
2020-07-24 22:09:55 -04:00
2020-10-02 18:53:06 -04:00
2020-02-04 03:05:26 +00:00
2021-08-26 08:35:37 -04:00
2019-05-30 11:29:53 -07:00
2021-12-01 09:19:05 +01:00
2020-03-16 22:08:36 -04:00
2020-09-02 22:49:07 -04:00
2021-12-08 09:03:19 +01:00
2021-07-20 16:05:40 +02:00
2021-01-12 20:18:15 +01:00
2021-04-21 13:00:52 +02:00
2021-11-06 14:10:08 +01:00
2020-03-24 07:57:08 -06:00
2019-06-05 17:37:14 +02:00
2021-09-30 10:11:01 +02:00
2021-10-09 14:40:56 +02:00
2020-10-14 15:15:35 -07:00
2020-09-15 20:28:06 -04:00
2021-10-17 10:43:33 +02:00
2020-10-03 00:02:13 -04:00
2020-09-25 06:20:44 +02:00
2019-05-24 17:36:45 +02:00
2021-05-14 09:50:27 +02:00
2020-02-24 14:59:01 -05:00
2021-08-12 13:22:04 +02:00
2020-02-24 15:01:57 -05:00
2021-04-07 15:00:05 +02:00
2020-03-11 23:07:56 -04:00
2021-07-20 16:05:43 +02:00
2020-08-23 17:36:59 -05:00
2021-05-14 09:50:27 +02:00
2020-10-02 21:52:55 -04:00
2021-10-17 10:43:33 +02:00
2021-06-16 12:01:37 +02:00
2020-08-23 17:36:59 -05:00
2019-05-24 17:39:02 +02:00
2019-07-11 15:14:01 -07:00
2018-11-15 14:27:08 -05:00
2020-08-23 17:36:59 -05:00
2020-01-06 09:45:59 +01:00
2019-05-21 10:50:45 +02:00
2020-06-09 09:39:13 -07:00