scsi: megaraid_sas: Check user-provided offsets

commit 381d34e376e3d9d27730fda8a0e870600e6c8196 upstream.

It sounds unwise to let user space pass an unchecked 32-bit offset into a
kernel structure in an ioctl. This is an unsigned variable, so checking the
upper bound for the size of the structure it points into is sufficient to
avoid data corruption, but as the pointer might also be unaligned, it has
to be written carefully as well.

While I stumbled over this problem by reading the code, I did not continue
checking the function for further problems like it.

Link: https://lore.kernel.org/r/20201030164450.1253641-2-arnd@kernel.org
Fixes: c4a3e0a529ab ("[SCSI] MegaRAID SAS RAID: new driver")
Cc: <stable@vger.kernel.org> # v2.6.15+
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 21f971447dd8c0abe3b2969e49df4d31c6f7ff40..83d25ee88f028482c16b843a59c65ec03b2f9c5d 100644 (file)
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -7192,7 +7192,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
        int error = 0, i;
        void *sense = NULL;
        dma_addr_t sense_handle;
-       unsigned long *sense_ptr;
+       void *sense_ptr;
        u32 opcode = 0;
 
        memset(kbuff_arr, 0, sizeof(kbuff_arr));
@@ -7309,6 +7309,13 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
        }
 
        if (ioc->sense_len) {
+               /* make sure the pointer is part of the frame */
+               if (ioc->sense_off >
+                   (sizeof(union megasas_frame) - sizeof(__le64))) {
+                       error = -EINVAL;
+                       goto out;
+               }
+
                sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len,
                                             &sense_handle, GFP_KERNEL);
                if (!sense) {
@@ -7316,12 +7323,11 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
                        goto out;
                }
 
-               sense_ptr =
-               (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
+               sense_ptr = (void *)cmd->frame + ioc->sense_off;
                if (instance->consistent_mask_64bit)
-                       *sense_ptr = cpu_to_le64(sense_handle);
+                       put_unaligned_le64(sense_handle, sense_ptr);
                else
-                       *sense_ptr = cpu_to_le32(sense_handle);
+                       put_unaligned_le32(sense_handle, sense_ptr);
        }
 
        /*