From nobody Fri Sep 25 23:12:13 2026 Received: from mail-pj2-f12.google.com (mail-pj2-f12.google.com [74.125.227.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AABF397692 for ; Sat, 19 Sep 2026 22:26:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.140 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789856790; cv=none; b=M0MNvAijcOM6DZjQZ8JKLmUantoBdNZFbmFX75we9y/Hwcst0uBLBB8pMabDjjsPjmmeSZmhsRCDcJS3zihlZwAK6vMso9SxvVQmkUj8IJECFcozLXrD2XajqDF6pdGyeKSFEz8fcOiekr6KQi/ONhIC7QorXYRJCX5ozmflle8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789856790; c=relaxed/simple; bh=gU93zAzsOoQ1roR6T6OlNqwkUWFuikccQakX9808gFA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Kj6miZqvrld1StKcDKmP3U1DGfxYw/GXciT5WQxnfUPx8cosUtArm/B1Tiub/UD4Hn+vC+/fOp36oRQcTkQTuvWgKSuQ9zGJ/FABos6aiKAl0V2NOsrpfH12UTsZtYce/6gGcpsEqq55IuIhHDNSuEoG2V9EN2X3GlfSFFgmlns= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ldAToeH7; arc=none smtp.client-ip=74.125.227.140 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ldAToeH7" Received: by mail-pj2-f12.google.com with SMTP id 98e67ed59e1d1-396cccbba91so1278914a91.1 for ; Sat, 19 Sep 2026 15:26:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789856788; x=1790461588; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=AHexZoASrrLFUeP2m4HCenY6Z1qSfaQk6YYJHltbZIA=; b=ldAToeH7rvrAqYS/pCUkXqOI0Qmyk8GeEgaYYUkixo3QFHN7Sx2MhcE0CbXnpPBhkI Ypif5eZYRPt+rfG3P9wztKZPAd4c8Rqc1ITZN68JXlVjMBxDkOTBXieD23SvwXep0ZC7 qrd6MUQhcnXAZk9QI1uZX+/VdGhdg39lVAXnthtJo2eRmdGFqz+/btK3OqBRaT1q9PkF XqOKo00/XRLYItFKvR4wGx2JwuT7SAYJDNUkk+n3sdkUJTZsnDeR60LOQ6p8bZ9aInMS 7rwcW/OQ8Sw0fF/OvWE/baYGv8Q3wso3U/0WHYNBHwKW1cw2Pozcha73UeExAhgunQPc Zzeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789856788; x=1790461588; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AHexZoASrrLFUeP2m4HCenY6Z1qSfaQk6YYJHltbZIA=; b=M3Skt2XZfX0ShtIKXBoHdQ4AsNt6xShSZsHARjVaBucFsSv+3agg75bmoI+lUkHuRF LNyO2f91Nuod9V3ylAtEYngmhhzk70q8yBpOO/fz5zlyV1SsNL+Sy5yw26gugXfpw8z7 g5pZzURGkHjD6S++N320JndiCZ15QPLCaquZdXPjI+F5V+sx6nTUh9WqvtadyLrzb6aP 0nCs1KJwiI0rHUeGbgNY2WSyJeHrIfkjoxvqmRcx+Ps8LX4px5pH5bFKhK7drOxpYi6g mJStztRQibiaESxnxit6eooTVDROLXVHqyLW4PI0ByiqsBCkAWB1AmSLVfb5mcW8amC4 /HAg== X-Forwarded-Encrypted: i=1; AKwUvByiaY+G+sRn8531+pLJHEfaaa0B1/U5974aMm4M8qBlZnRYsqJavjBwD29brPflZZgvrHU09/Ep/wHETVg=@vger.kernel.org X-Gm-Message-State: AFuF++lzu9XxeNGseSSxPVwR59I+jPFIoRwXDE2jy/wDEjKAIsIpPATZ RQZ2jnpYqzaUBBcHdxzMGJN3k4eonf/oa0t8V2WKn++gtARjs4BL5F6O X-Gm-Gg: AYBFou3+z3Vqa2gtUV0+KcxMI2SjpQyWldSD0kcS0q3m5KTDRaT9ShfrhLTNefSIck7 cz849FvHaNpwiBbt/To2ADB8/+BB4cwahKs6bJibVH2MhR3ey9DQCt94IEhdI8vmqQ6KM8B3BSd lJI2mdjSEi+DVI+su4dP+1LkX9mAJNYyRExGJz6G58HP+yR0/RyPB75tYw/5U6f0O+KFPnxn8kP 4GV52skZ9qMWAbpPLmiUfHwk5fwPJ5NeYaCeiGaebX32zUmgWnPsCa+oaZJkVSiWVDQxM/EBERU 8fHnXy30Q6Qq9X0M7QcfHPsDgZiFk28TgMaum0XtlfHk/Kpgbc6URFzVMzpAB+h0KgQBPxV9f8m 4AgONh/IwAhs2PqI8nNKzp5HKJWoBERPeyj1QzQ1q710LZGwqnWHAqIXqXWdvAHZs4KUxfrtxIx C357TbpRmeEaWFZAVbODY4410X78pwp9Iv7KbCx3W+17PpWI7RC7wFF0m30A9VJwLB8KYMe5Bsd 89M3rb5ziVNOfvim+x6ra3oT47eIaeNfId0H9IkcQ4HRkddVUDahY3yJ0LakiMOOEZV014IXxBG 48+ux54UGQ== X-Received: by 2002:a17:90b:2d03:b0:39e:1c03:14c2 with SMTP id 98e67ed59e1d1-39e54baa3f1mr10887430a91.11.1789856787653; Sat, 19 Sep 2026 15:26:27 -0700 (PDT) Received: from phui-2.c.googlers.com.com (78.123.83.34.bc.googleusercontent.com. [34.83.123.78]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39e6c3145e5sm6614629a91.5.2026.09.19.15.26.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 19 Sep 2026 15:26:27 -0700 (PDT) From: Hui Peng To: dgilbert@interlog.com, James.Bottomley@HansenPartnership.com, mkp@kernel.org Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] scsi: sg, sr: fix stale scatter_elem_sz in sg_build_indirect() and OOB read in sr_is_xa() Date: Sat, 19 Sep 2026 22:26:26 +0000 Message-ID: <20260919222626.3797788-1-benquike@gmail.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix two issues in drivers/scsi/sg.c and drivers/scsi/sr_ioctl.c: 1. In sg_build_indirect() (drivers/scsi/sg.c), snapshot scatter_elem_sz into a local variable and clamp it to [PAGE_SIZE, SG_SCATTER_SZ] so a concurrent SG_SET_RESERVED_SIZE ioctl cannot cause inconsistent page order calculations or unbounded order-10 allocations. 2. In sr_is_xa() (drivers/scsi/sr_ioctl.c), allocate at least 2048 bytes (or CD_FRAMESIZE_RAW) before calling sr_read_sector() so reading sector data at offset + 14 does not read or write past the kmalloc buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: LLM Signed-off-by: Hui Peng --- diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 5408f002e6c0..5d635349e06e 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -480,8 +480,10 @@ sg_read(struct file *filp, char __user *buf, size_t co= unt, loff_t * ppos) =20 hp =3D &srp->header; old_hdr =3D kzalloc(SZ_SG_HEADER, GFP_KERNEL); - if (!old_hdr) - return -ENOMEM; + if (!old_hdr) { + retval =3D -ENOMEM; + goto free_old_hdr; + } =20 old_hdr->reply_len =3D (int) hp->timeout; old_hdr->pack_len =3D old_hdr->reply_len; /* old, strange behaviour */ @@ -543,10 +545,10 @@ sg_read(struct file *filp, char __user *buf, size_t c= ount, loff_t * ppos) } } else count =3D (old_hdr->result =3D=3D 0) ? 0 : -EIO; - sg_finish_rem_req(srp); - sg_remove_request(sfp, srp); retval =3D count; free_old_hdr: + sg_finish_rem_req(srp); + sg_remove_request(sfp, srp); kfree(old_hdr); return retval; } @@ -1667,9 +1669,12 @@ init_sg(void) { int rc; =20 - if (scatter_elem_sz < PAGE_SIZE) { + if (scatter_elem_sz < (int)PAGE_SIZE) { scatter_elem_sz =3D PAGE_SIZE; scatter_elem_sz_prev =3D scatter_elem_sz; + } else if (scatter_elem_sz > (int)(PAGE_SIZE << MAX_PAGE_ORDER)) { + scatter_elem_sz =3D PAGE_SIZE << MAX_PAGE_ORDER; + scatter_elem_sz_prev =3D scatter_elem_sz; } =20 rc =3D register_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),=20 @@ -1875,9 +1880,14 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sf= p, int buff_size) =20 num =3D scatter_elem_sz; if (unlikely(num !=3D scatter_elem_sz_prev)) { - if (num < PAGE_SIZE) { + if (num < (int)PAGE_SIZE) { + num =3D PAGE_SIZE; scatter_elem_sz =3D PAGE_SIZE; scatter_elem_sz_prev =3D PAGE_SIZE; + } else if (num > (int)(PAGE_SIZE << MAX_PAGE_ORDER)) { + num =3D PAGE_SIZE << MAX_PAGE_ORDER; + scatter_elem_sz =3D PAGE_SIZE << MAX_PAGE_ORDER; + scatter_elem_sz_prev =3D PAGE_SIZE << MAX_PAGE_ORDER; } else scatter_elem_sz_prev =3D num; } diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 089653018d32..2a3ce6a460ed 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -582,7 +582,7 @@ int sr_is_xa(Scsi_CD *cd) if (!xa_test) return 0; =20 - raw_sector =3D kmalloc(2048, GFP_KERNEL); + raw_sector =3D kmalloc(CD_FRAMESIZE_RAW1, GFP_KERNEL); if (!raw_sector) return -ENOMEM; if (0 =3D=3D sr_read_sector(cd, cd->ms_offset + 16,