Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14faa944 authored by Akinobu Mita's avatar Akinobu Mita Committed by James Bottomley
Browse files

[SCSI] scsi_debug: fix buffer overrun when DIF/DIX is enabled and virtual_gb > 0 



If the module parameter virtual_gb is greater than 0, the READ command
may request the blocks which exceed actual ramdisk storage (fake_storep).
prot_verify_read() should treat those blocks as wrap around the end of
fake_storep.  But it actually causes fake_storep and dif_storep buffer
overruns.

This fixes these buffer overruns.  In order to simplify the fix,
this also introduces fake_store() and dif_store() which return
corresponding wrap around addresses.

Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent 214ab31c

drivers/scsi/scsi_debug.c

+30 −18
Original line number Diff line number Diff line
@@ -293,6 +293,20 @@ static unsigned char ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0, 
static unsigned char iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,

			           0, 0, 0x0, 0x0};



static void *fake_store(unsigned long long lba)

{

	lba = do_div(lba, sdebug_store_sectors);



	return fake_storep + lba * scsi_debug_sector_size;

}



static struct sd_dif_tuple *dif_store(sector_t sector)

{

	sector = do_div(sector, sdebug_store_sectors);



	return dif_storep + sector;

}



static int sdebug_add_adapter(void);

static void sdebug_remove_adapter(void);
@@ -1782,24 +1796,19 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec, 
	struct scatterlist *psgl;

	struct sd_dif_tuple *sdt;

	sector_t sector;

	sector_t tmp_sec = start_sec;

	void *paddr;



	start_sec = do_div(tmp_sec, sdebug_store_sectors);



	sdt = dif_storep + start_sec;

	const void *dif_store_end = dif_storep + sdebug_store_sectors;



	for (i = 0; i < sectors; i++) {

		int ret;



		if (sdt[i].app_tag == 0xffff)

			continue;



		sector = start_sec + i;

		sdt = dif_store(sector);



		if (sdt->app_tag == 0xffff)

			continue;



		ret = dif_verify(&sdt[i],

				 fake_storep + sector * scsi_debug_sector_size,

				 sector, ei_lba);

		ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);

		if (ret) {

			dif_errors++;

			return ret;
@@ -1814,16 +1823,19 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec, 


	scsi_for_each_prot_sg(SCpnt, psgl, scsi_prot_sg_count(SCpnt), i) {

		int len = min(psgl->length, resid);

		void *start = dif_store(sector);

		int rest = 0;



		if (dif_store_end < start + len)

			rest = start + len - dif_store_end;



		paddr = kmap_atomic(sg_page(psgl)) + psgl->offset;

		memcpy(paddr, dif_storep + sector, len);

		memcpy(paddr, start, len - rest);



		if (rest)

			memcpy(paddr + len - rest, dif_storep, rest);



		sector += len / sizeof(*dif_storep);

		if (sector >= sdebug_store_sectors) {

			/* Force wrap */

			tmp_sec = sector;

			sector = do_div(tmp_sec, sdebug_store_sectors);

		}

		resid -= len;

		kunmap_atomic(paddr);

	}