Closed GustavoARSilva closed 1 year ago
drivers/scsi/pm8001/pm8001_sas.h:
603 struct fw_control_info { 604 u32 retcode;/*ret code (status)*/ 605 u32 phase;/*ret code phase*/ 606 u32 phaseCmplt;/*percent complete for the current 607 update phase */ 608 u32 version;/*Hex encoded firmware version number*/ 609 u32 offset;/*Used for downloading firmware */ 610 u32 len; /*len of buffer*/ 611 u32 size;/* Used in OS VPD and Trace get size 612 operations.*/ 613 u32 reserved;/* padding required for 64 bit 614 alignment */ 615 u8 buffer[1];/* Start of buffer */ 616 };
Audit (at least) all these places where the flex array is being used:
diff -u -p drivers/scsi/pm8001/pm8001_ctl.c /tmp/nothing/pm8001/pm8001_ctl.c --- drivers/scsi/pm8001/pm8001_ctl.c +++ /tmp/nothing/pm8001/pm8001_ctl.c @@ -768,10 +768,8 @@ static int pm8001_update_flash(struct pm if (loopcount - loopNumber == 1 && fc_len) { fwControl->len = fc_len; - memcpy((u8 *)fwControl->buffer, read_buf, fc_len); sizeRead += fc_len; } else { - memcpy((u8 *)fwControl->buffer, read_buf, IOCTL_BUF_SIZE); sizeRead += IOCTL_BUF_SIZE; }
diff -u -p drivers/scsi/pm8001/pm8001_hwi.c /tmp/nothing/pm8001/pm8001_hwi.c --- drivers/scsi/pm8001/pm8001_hwi.c +++ /tmp/nothing/pm8001/pm8001_hwi.c @@ -4774,7 +4774,6 @@ pm8001_chip_fw_flash_update_req(struct p pm8001_dbg(pm8001_ha, DEVIO, "dma fw_control context input length :%x\n", fw_control->len); - memcpy(buffer, fw_control->buffer, fw_control->len); flash_update_info.sgl.addr = cpu_to_le64(phys_addr); flash_update_info.sgl.im_len.len = cpu_to_le32(fw_control->len); flash_update_info.sgl.im_len.e = 0;
I just sent a patch for this: https://lore.kernel.org/linux-hardening/Yyy31OuBza1FJCXP@work/
drivers/scsi/pm8001/pm8001_sas.h:
Audit (at least) all these places where the flex array is being used: