diff options
| author | Stanley Jhu <stanleyjhu@google.com> | 2026-10-15 08:18:53 +0800 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-10-23 22:35:45 -0400 |
| commit | 42aa443718104d10dbdb6f258810b425eb2451f8 (patch) | |
| tree | f7bdffd9c8713b59c67485c94a4ecfabe746a536 /tools/lib/python/kdoc/python_version.py | |
| parent | 2e63ac76cc08ea376ba61fef52f7b7849e35024d (diff) | |
scsi: ufs: bsg: Validate request_len before accessing request
ufs_bsg_request() and ufs_bsg_exec_advanced_rpmb_req() read the request
buffer without checking job->request_len, which userspace controls. A short
request causes an out-of-bounds read. Found by syzkaller.
Reject requests shorter than the structure each path reads.
Fixes: 64d4864714c2 ("scsi: ufs: bsg: Remove unnecessary length checkup")
Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg")
Cc: stable@vger.kernel.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20261015001855.3450573-4-stanleyjhu@google.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions