Patch "scsi: sr: Sanity check returned mode data" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

scsi: sr: Sanity check returned mode data

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
scsi-sr-sanity-check-returned-mode-data.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Martin K. Petersen" <[email protected]>
Date: Fri, 17 Mar 2017 08:47:14 -0400
Subject: scsi: sr: Sanity check returned mode data

From: Martin K. Petersen <[email protected]>

commit a00a7862513089f17209b732f230922f1942e0b9 upstream.

Kefeng Wang discovered that old versions of the QEMU CD driver would return mangled mode data causing us to walk off the end of the buffer in an attempt to parse it. Sanity check the returned mode sense data.

---
 drivers/scsi/sr.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -839,6 +839,7 @@ static void get_capabilities(struct scsi
 	unsigned char *buffer;
 	struct scsi_mode_data data;
 	struct scsi_sense_hdr sshdr;
+	unsigned int ms_len = 128;
 	int rc, n;
 
 	static const char *loadmech[] =

@@ -865,10 +866,11 @@ static void get_capabilities(struct scsi
 	scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
 
 	/* ask for mode page 0x2a */
-	rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128,
+	rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len,
 			     SR_TIMEOUT, 3, &data, NULL);
 
-	if (!scsi_status_is_good(rc)) {
+	if (!scsi_status_is_good(rc) || data.length > ms_len ||
+	    data.header_length + data.block_descriptor_length > data.length) {
 		/* failed, drive doesn't have capabilities mode page */
 		cd->cdi.speed = 1;
 		cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R |

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/scsi-sr-sanity-check-returned-mode-data.patch queue-3.18/scsi-sd-fix-capacity-calculation-with-32-bit-sector_t.patch