Re: [PATCH] SCSI: Fix potential out-of-bounds access in drivers/scsi/sd.c

2013-09-09 Thread Hannes Reinecke
On 09/06/2013 06:24 PM, Paolo Bonzini wrote: Il 06/09/2013 17:49, Alan Stern ha scritto: This patch fixes an out-of-bounds error in sd_read_cache_type(), found by Google's AddressSanitizer tool. When the loop ends, we know that offset lies beyond the end of the data in the buffer, so no

[PATCH] SCSI: Fix potential out-of-bounds access in drivers/scsi/sd.c

2013-09-06 Thread Alan Stern
This patch fixes an out-of-bounds error in sd_read_cache_type(), found by Google's AddressSanitizer tool. When the loop ends, we know that offset lies beyond the end of the data in the buffer, so no Caching mode page was found. In theory it may be present, but the buffer size is limited to 512

Re: [PATCH] SCSI: Fix potential out-of-bounds access in drivers/scsi/sd.c

2013-09-06 Thread Paolo Bonzini
Il 06/09/2013 17:49, Alan Stern ha scritto: This patch fixes an out-of-bounds error in sd_read_cache_type(), found by Google's AddressSanitizer tool. When the loop ends, we know that offset lies beyond the end of the data in the buffer, so no Caching mode page was found. In theory it may be

Re: Potential out-of-bounds access in drivers/scsi/sd.c

2013-09-05 Thread Hannes Reinecke
On 09/04/2013 05:42 PM, Alan Stern wrote: On Wed, 4 Sep 2013, Paolo Bonzini wrote: --- usb-3.11.orig/drivers/scsi/sd.c +++ usb-3.11/drivers/scsi/sd.c @@ -2419,7 +2419,7 @@ sd_read_cache_type(struct scsi_disk *sdk } } - if (modepage == 0x3F) {

Re: Potential out-of-bounds access in drivers/scsi/sd.c

2013-09-04 Thread Paolo Bonzini
Il 04/09/2013 16:32, Alan Stern ha scritto: On Wed, 4 Sep 2013, Dmitry Vyukov wrote: Hi, We are working on a memory error detector AddressSanitizer for Linux kernel (https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel), it can detect use-after-free and

Re: Potential out-of-bounds access in drivers/scsi/sd.c

2013-09-04 Thread Alan Stern
On Wed, 4 Sep 2013, Dmitry Vyukov wrote: Hi, We are working on a memory error detector AddressSanitizer for Linux kernel (https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel), it can detect use-after-free and buffer-overflow errors. ... The code in

Re: Potential out-of-bounds access in drivers/scsi/sd.c

2013-09-04 Thread Alan Stern
On Wed, 4 Sep 2013, Paolo Bonzini wrote: --- usb-3.11.orig/drivers/scsi/sd.c +++ usb-3.11/drivers/scsi/sd.c @@ -2419,7 +2419,7 @@ sd_read_cache_type(struct scsi_disk *sdk } } - if (modepage == 0x3F) { + if (modepage == 0x3F ||

Re: Potential out-of-bounds access in drivers/scsi/sd.c

2013-09-04 Thread Dmitry Vyukov
On Wed, Sep 4, 2013 at 6:32 PM, Alan Stern st...@rowland.harvard.edu wrote: On Wed, 4 Sep 2013, Dmitry Vyukov wrote: Hi, We are working on a memory error detector AddressSanitizer for Linux kernel (https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel), it can detect

Re: Potential out-of-bounds access in drivers/scsi/sd.c

2013-09-04 Thread Alan Stern
On Wed, 4 Sep 2013, Dmitry Vyukov wrote: Thanks, Alan! I agree with Paolo that the branch can be removed. Will you take care of landing the patch? I will when everyone agrees it is ready. Alan Stern -- To unsubscribe from this list: send the line unsubscribe linux-scsi in the body of a

Potential out-of-bounds access in drivers/scsi/sd.c

2013-09-03 Thread Dmitry Vyukov
Hi, We are working on a memory error detector AddressSanitizer for Linux kernel (https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel), it can detect use-after-free and buffer-overflow errors. Here one of the reports from the tool: [ 166.124485] ERROR: AddressSanitizer: