Skip to contentSkip to conversation

fc_transport: Write outside array bounds

PATCH In review Roel Kluin 2 participants 2 messages Jul 28, 2009 SCSI

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 fc_transport: Write outside array bounds

If it's possible to turn on all the optional attributes, there are more attributes than the length of array i->private_host_attrs[], so the last one will be out-of-bounds. (There is a BUG_ON there, but it's after the write, rather than before).

Signed-off-by Roel Kluin <[email protected]>

---
Found with Parfait, http://research.sun.com/projects/parfait/

in fc_attach_transport()
...
count=0;
14 x SETUP_HOST_ATTRIBUTE_RD()
if (ft->vport_create)
2 x SETUP_HOST_ATTRIBUTE_RD_NS()
1 x SETUP_HOST_ATTRIBUTE_RW()
1 - 4 x SETUP_PRIVATE_HOST_ATTRIBUTE_RW()

all these definitions set private_host_attrs[count] (21 elements) and increase the index count thereafter.

drivers/scsi/scsi_transport_fc.c +6 -2
index 292c02f..8092e56 100644
@@ -2123,8 +2123,12 @@ fc_attach_transport(struct fc_function_template *ft)
 		SETUP_PRIVATE_HOST_ATTRIBUTE_RW(issue_lip);
 	if (ft->vport_create)
 		SETUP_PRIVATE_HOST_ATTRIBUTE_RW(vport_create);
-	if (ft->vport_delete)
-		SETUP_PRIVATE_HOST_ATTRIBUTE_RW(vport_delete);
+	if (ft->vport_delete) {
+		if(count < FC_HOST_NUM_ATTRS)
+			SETUP_PRIVATE_HOST_ATTRIBUTE_RW(vport_delete);
+		else
+			count++;
+	}
 
 	BUG_ON(count > FC_HOST_NUM_ATTRS);
#1 lore raw

This shouldn't be the case, and if it is, isn't the right way to handle it. It may simply be someone forgot to update FC_HOST_NUM_ATTRS. I'll double check and get back shortly.

-- james s

Quoted 45 lines · Roel Kluin

If it's possible to turn on all the optional attributes, there are more attributes than the length of array i->private_host_attrs[], so the last one will be out-of-bounds. (There is a BUG_ON there, but it's after the write, rather than before).

Signed-off-by Roel Kluin <[email protected]>

---
Found with Parfait, http://research.sun.com/projects/parfait/

in fc_attach_transport()
...
count=0;
14 x SETUP_HOST_ATTRIBUTE_RD()
if (ft->vport_create)
2 x SETUP_HOST_ATTRIBUTE_RD_NS()
1 x SETUP_HOST_ATTRIBUTE_RW()
1 - 4 x SETUP_PRIVATE_HOST_ATTRIBUTE_RW()

all these definitions set private_host_attrs[count] (21 elements) and increase the index count thereafter.

drivers/scsi/scsi_transport_fc.c +6 -3
index 292c02f..8092e56 100644
@@ -2123,8 +2123,12 @@ fc_attach_transport(struct fc_function_template *ft)
 		SETUP_PRIVATE_HOST_ATTRIBUTE_RW(issue_lip);
 	if (ft->vport_create)
 		SETUP_PRIVATE_HOST_ATTRIBUTE_RW(vport_create);
-	if (ft->vport_delete)
-		SETUP_PRIVATE_HOST_ATTRIBUTE_RW(vport_delete);
+	if (ft->vport_delete) {
+		if(count < FC_HOST_NUM_ATTRS)
+			SETUP_PRIVATE_HOST_ATTRIBUTE_RW(vport_delete);
+		else
+			count++;
+	}
 
 	BUG_ON(count > FC_HOST_NUM_ATTRS);
 
--

To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html