Commit ab4fb1d8 authored by Stefan Hajnoczi's avatar Stefan Hajnoczi Committed by Jens Axboe
Browse files

scsi: sd: reject invalid pr_read_keys() num_keys values 



The pr_read_keys() interface has a u32 num_keys parameter. The SCSI
PERSISTENT RESERVE IN command has a maximum READ KEYS service action
size of 65536 bytes. Reject num_keys values that are too large to fit
into the SCSI command.

This will become important when pr_read_keys() is exposed to untrusted
userspace via an <linux/pr.h> ioctl.

Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 48f22f80

drivers/scsi/sd.c

+11 −1
Original line number Diff line number Diff line
@@ -1974,9 +1974,19 @@ static int sd_pr_read_keys(struct block_device *bdev, struct pr_keys *keys_info) 
{

	int result, i, data_offset, num_copy_keys;

	u32 num_keys = keys_info->num_keys;

	int data_len = num_keys * 8 + 8;

	int data_len;

	u8 *data;



	/*

	 * Each reservation key takes 8 bytes and there is an 8-byte header

	 * before the reservation key list. The total size must fit into the

	 * 16-bit ALLOCATION LENGTH field.

	 */

	if (check_mul_overflow(num_keys, 8, &data_len) ||

	    check_add_overflow(data_len, 8, &data_len) ||

	    data_len > USHRT_MAX)

		return -EINVAL;



	data = kzalloc(data_len, GFP_KERNEL);

	if (!data)

		return -ENOMEM;