[PATCH v7 05/12] virtio_scsi: Add validation for residual bytes from response
From: Xie Yongji <hidden>
Date: 2021-05-17 09:56:37
Also in:
kvm, linux-fsdevel, linux-iommu, lkml
Subsystem:
scsi subsystem, the rest, virtio block and scsi drivers · Maintainers:
"James E.J. Bottomley", "Martin K. Petersen", Linus Torvalds, "Michael S. Tsirkin", Jason Wang
This ensures that the residual bytes in response (might come from an untrusted device) will not exceed the data buffer length. Signed-off-by: Xie Yongji <redacted> --- drivers/scsi/virtio_scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index efcaf0674c8d..ad7d8cecec32 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c@@ -97,7 +97,7 @@ static inline struct Scsi_Host *virtio_scsi_host(struct virtio_device *vdev) static void virtscsi_compute_resid(struct scsi_cmnd *sc, u32 resid) { if (resid) - scsi_set_resid(sc, resid); + scsi_set_resid(sc, min(resid, scsi_bufflen(sc))); } /*
--
2.11.0