KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

Replace 1-element array in drivers/scsi/qla2xxx/qla_def.h #245

Closed GustavoARSilva closed 1 year ago

GustavoARSilva commented 1 year ago

Replace one-element array with flexible-array member in drivers/scsi/qla2xxx/qla_def.h:

/* It's the same for both GPN_FT and GNN_FT */
struct ct_sns_gpnft_rsp {
        struct {
                struct ct_cmd_hdr header;
                uint16_t response;
                uint16_t residual;
                uint8_t fragment_id;
                uint8_t reason_code;
                uint8_t explanation_code;
                uint8_t vendor_unique;
        };
        /* Assume the largest number of targets for the union */
        struct ct_sns_gpn_ft_data {
                u8 control_byte;
                u8 port_id[3];
                u32 reserved;
                u8 port_name[8];
        } entries[1];
};

Audit (at least) all these places where the fake flex array is being used:

diff -u -p ./drivers/scsi/qla2xxx/qla_gs.c /tmp/nothing/drivers/scsi/qla2xxx/qla_gs.c
--- ./drivers/scsi/qla2xxx/qla_gs.c
+++ /tmp/nothing/drivers/scsi/qla2xxx/qla_gs.c
@@ -3731,7 +3731,6 @@ static void qla2x00_find_free_fcp_nvme_s

        j = 0;
        for (i = 0; i < num_fibre_dev; i++) {
-               d  = &ct_rsp->entries[i];

                id.b.rsvd_1 = 0;
                id.b.domain = d->port_id[0];
GustavoARSilva commented 1 year ago

https://lore.kernel.org/linux-hardening/cover.1668814746.git.gustavoars@kernel.org/T/