[kernel/f15/master] [SCSI] mpt2sas: prevent heap overflows and unchecked reads

[Chuck Ebbert]

commit 6034fb773e28ddc0540dfd809d82728b52543532
Author: Chuck Ebbert <cebbert at redhat.com>
Date:   Mon May 2 18:30:35 2011 -0400

    [SCSI] mpt2sas: prevent heap overflows and unchecked reads

 kernel.spec                                        |   10 +++
 ...revent-heap-overflows-and-unchecked-reads.patch |   83 ++++++++++++++++++++
 2 files changed, 93 insertions(+), 0 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index 4b1898a..b92634d 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -726,6 +726,9 @@ Patch12306: scsi-sd-downgrade-caching-printk-from-error-to-notice.patch
 #netconsole fixes
 Patch12400: linux-2.6-netconsole-deadlock.patch
 
+# CVE-2011-1494, CVE-2011-1495
+Patch12401: scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1345,6 +1348,9 @@ ApplyPatch scsi-sd-downgrade-caching-printk-from-error-to-notice.patch
 #rhbz 668231
 ApplyPatch linux-2.6-netconsole-deadlock.patch
 
+# CVE-2011-1494, CVE-2011-1495
+ApplyPatch scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1953,6 +1959,10 @@ fi
 # and build.
 
 %changelog
+* Mon May 02 2011 Chuck Ebbert <cebbert at redhat.com>
+- [SCSI] mpt2sas: prevent heap overflows and unchecked reads
+  (CVE-2011-1494, CVE-2011-1495)
+
 * Mon May 02 2011 Kyle McMartin <kmcmartin at redhat.com> 2.6.38.5-22
 - And to the released 2.6.38.5
 
diff --git a/scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch b/scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch
new file mode 100644
index 0000000..1803cf8
--- /dev/null
+++ b/scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch
@@ -0,0 +1,83 @@
+From: Dan Rosenberg <drosenberg at vsecurity.com>
+Date: Tue, 5 Apr 2011 16:45:59 +0000 (-0400)
+Subject: [SCSI] mpt2sas: prevent heap overflows and unchecked reads
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a1f74ae82d133ebb2aabb19d181944b4e83e9960
+
+[SCSI] mpt2sas: prevent heap overflows and unchecked reads
+
+At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
+length values are used to copy data from userspace into heap buffers
+without bounds checking, allowing controllable heap corruption and
+subsequently privilege escalation.
+
+Additionally, user-supplied values are used to determine the size of a
+copy_to_user() as well as the offset into the buffer to be read, with no
+bounds checking, allowing users to read arbitrary kernel memory.
+
+Signed-off-by: Dan Rosenberg <drosenberg at vsecurity.com>
+Cc: stable at kernel.org
+Acked-by: Eric Moore <eric.moore at lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley at suse.de>
+---
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+index 1c6d2b4..d72f1f2 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
+ 		goto out;
+ 	}
+ 
++	/* Check for overflow and wraparound */
++	if (karg.data_sge_offset * 4 > ioc->request_sz ||
++	    karg.data_sge_offset > (UINT_MAX / 4)) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	/* copy in request message frame from user */
+ 	if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
+ 		printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
+@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
+ 	Mpi2DiagBufferPostReply_t *mpi_reply;
+ 	int rc, i;
+ 	u8 buffer_type;
+-	unsigned long timeleft;
++	unsigned long timeleft, request_size, copy_size;
+ 	u16 smid;
+ 	u16 ioc_status;
+ 	u8 issue_reset = 0;
+@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
+ 		return -ENOMEM;
+ 	}
+ 
++	request_size = ioc->diag_buffer_sz[buffer_type];
++
+ 	if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
+ 		printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
+ 		    "or bytes_to_read are not 4 byte aligned\n", ioc->name,
+@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
+ 		return -EINVAL;
+ 	}
+ 
++	if (karg.starting_offset > request_size)
++		return -EINVAL;
++
+ 	diag_data = (void *)(request_data + karg.starting_offset);
+ 	dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
+ 	    "offset(%d), sz(%d)\n", ioc->name, __func__,
+ 	    diag_data, karg.starting_offset, karg.bytes_to_read));
+ 
++	/* Truncate data on requests that are too large */
++	if ((diag_data + karg.bytes_to_read < diag_data) ||
++	    (diag_data + karg.bytes_to_read > request_data + request_size))
++		copy_size = request_size - karg.starting_offset;
++	else
++		copy_size = karg.bytes_to_read;
++
+ 	if (copy_to_user((void __user *)uarg->diagnostic_data,
+-	    diag_data, karg.bytes_to_read)) {
++	    diag_data, copy_size)) {
+ 		printk(MPT2SAS_ERR_FMT "%s: Unable to write "
+ 		    "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
+ 		    __func__, diag_data);