Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79ec5dd5 authored by Tomas Henzl's avatar Tomas Henzl Committed by Greg Kroah-Hartman
Browse files

scsi: ses: Fix possible desc_ptr out-of-bounds accesses 

commit 801ab13d50cf3d26170ee073ea8bb4eececb76ab upstream.

Sanitize possible desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().

Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com


Cc: stable@vger.kernel.org
Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8e454aba

drivers/scsi/ses.c

+9 −5
Original line number Diff line number Diff line
@@ -572,17 +572,21 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, 
			int max_desc_len;



			if (desc_ptr) {

				if (desc_ptr >= buf + page7_len) {

				if (desc_ptr + 3 >= buf + page7_len) {

					desc_ptr = NULL;

				} else {

					len = (desc_ptr[2] << 8) + desc_ptr[3];

					desc_ptr += 4;

					if (desc_ptr + len > buf + page7_len)

						desc_ptr = NULL;

					else {

						/* Add trailing zero - pushes into

						 * reserved space */

						desc_ptr[len] = '\0';

						name = desc_ptr;

					}

				}

			}

			if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||

			    type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) {