From owner-svn-src-all@freebsd.org Fri Apr 17 18:19:14 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 49CF72C3E91; Fri, 17 Apr 2020 18:19:14 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 493krL1JRKz4PCL; Fri, 17 Apr 2020 18:19:14 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 27B3B269EF; Fri, 17 Apr 2020 18:19:14 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 03HIJEFY023749; Fri, 17 Apr 2020 18:19:14 GMT (envelope-from jhb@FreeBSD.org) Received: (from jhb@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 03HIJDpV023747; Fri, 17 Apr 2020 18:19:13 GMT (envelope-from jhb@FreeBSD.org) Message-Id: <202004171819.03HIJDpV023747@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jhb set sender to jhb@FreeBSD.org using -f From: John Baldwin Date: Fri, 17 Apr 2020 18:19:13 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r360048 - head/sys/cam/scsi X-SVN-Group: head X-SVN-Commit-Author: jhb X-SVN-Commit-Paths: head/sys/cam/scsi X-SVN-Commit-Revision: 360048 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Apr 2020 18:19:14 -0000 Author: jhb Date: Fri Apr 17 18:19:13 2020 New Revision: 360048 URL: https://svnweb.freebsd.org/changeset/base/360048 Log: Don't try to copyout() to a kernel buffer. The handle_string callback for the ENCIOC_GET_ENCNAME and ENCIOC_GETENCID ioctls tries to copy the size of the generated string out to userland. However, the callback only has access to the kernel copy of the structure populated by copyin(). The copyout() call simply overwrites the value in the kernel's copy preventing the subsequent overflow prevention logic from working. Fix this by instead doing a copyout() of the updated length in the caller after the callback returns. Reviewed by: kib Obtained from: CheriBSD Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D24456 Modified: head/sys/cam/scsi/scsi_enc.c head/sys/cam/scsi/scsi_enc_ses.c Modified: head/sys/cam/scsi/scsi_enc.c ============================================================================== --- head/sys/cam/scsi/scsi_enc.c Fri Apr 17 17:05:58 2020 (r360047) +++ head/sys/cam/scsi/scsi_enc.c Fri Apr 17 18:19:13 2020 (r360048) @@ -489,6 +489,10 @@ enc_ioctl(struct cdev *dev, u_long cmd, caddr_t arg_ad cam_periph_lock(periph); error = enc->enc_vec.handle_string(enc, &sstr, cmd); cam_periph_unlock(periph); + if (error == 0 || error == ENOMEM) + (void)copyout(&sstr.bufsiz, + &((encioc_string_t *)addr)->bufsiz, + sizeof(sstr.bufsiz)); break; case ENCIOC_GETELMSTAT: Modified: head/sys/cam/scsi/scsi_enc_ses.c ============================================================================== --- head/sys/cam/scsi/scsi_enc_ses.c Fri Apr 17 17:05:58 2020 (r360047) +++ head/sys/cam/scsi/scsi_enc_ses.c Fri Apr 17 18:19:13 2020 (r360048) @@ -2926,11 +2926,11 @@ ses_handle_string(enc_softc_t *enc, encioc_string_t *s vendor, product, rev) + 1; if (rsize > sizeof(str)) rsize = sizeof(str); - copyout(&rsize, &sstr->bufsiz, sizeof(rsize)); size = rsize; if (size > sstr->bufsiz) size = sstr->bufsiz; copyout(str, sstr->buf, size); + sstr->bufsiz = rsize; return (size == rsize ? 0 : ENOMEM); case ENCIOC_GETENCID: if (ses_cache->ses_nsubencs < 1) @@ -2940,11 +2940,11 @@ ses_handle_string(enc_softc_t *enc, encioc_string_t *s scsi_8btou64(enc_desc->logical_id)) + 1; if (rsize > sizeof(str)) rsize = sizeof(str); - copyout(&rsize, &sstr->bufsiz, sizeof(rsize)); size = rsize; if (size > sstr->bufsiz) size = sstr->bufsiz; copyout(str, sstr->buf, size); + sstr->bufsiz = rsize; return (size == rsize ? 0 : ENOMEM); default: return (EINVAL);