diff options
| author | Dan Carpenter <error27@gmail.com> | 2026-04-10 13:14:52 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-04-10 15:41:26 +0300 |
| commit | 0a42ca4d2bff6306dd574a7897258fd02c2e6930 (patch) | |
| tree | 85285f6821308760f67ce4bd6b5e7ea804a71fc2 | |
| parent | 539fb773a3f7c07cf7fd00617f33ed4e33058d72 (diff) | |
| download | linux-0a42ca4d2bff6306dd574a7897258fd02c2e6930.tar.xz | |
scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd()
The bounds checking in scsi_bsg_uring_cmd() does not work because
cmd->request_len is a u32 and scmd->cmd_len is a u16. We check that
scmd->cmd_len is valid but if the cmd->request_len is more than
USHRT_MAX it would still lead to a buffer overflow when we do the
copy_from_user().
Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/adjNnMYK7A7KMNkA@stanley.mountain
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | drivers/scsi/scsi_bsg.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c index c3ce497a3b94..e80dec53174e 100644 --- a/drivers/scsi/scsi_bsg.c +++ b/drivers/scsi/scsi_bsg.c @@ -137,11 +137,11 @@ static int scsi_bsg_uring_cmd(struct request_queue *q, struct io_uring_cmd *iouc return PTR_ERR(req); scmd = blk_mq_rq_to_pdu(req); - scmd->cmd_len = cmd->request_len; - if (scmd->cmd_len > sizeof(scmd->cmnd)) { + if (cmd->request_len > sizeof(scmd->cmnd)) { ret = -EINVAL; goto out_free_req; } + scmd->cmd_len = cmd->request_len; scmd->allowed = SG_DEFAULT_RETRIES; if (copy_from_user(scmd->cmnd, uptr64(cmd->request), cmd->request_len)) { |