Sense-data bcopy and HBA reqlen use sense_len without bounding to sizeof(sense_data)
Summary
dpt_scsi.c:858 eccb->reqlen=csio->sense_len forwarded to HBA. HBA DMA-writes reqlen bytes into 32-byte sense_data -> overflows into CCB fields. :1594 bcopy(sense_len) from 32B source to 32B dest. sense_len u8 max 255. Sibling of DF-1454 sense overflow pattern. Latent (standard periphs use 32). Fix: clamp sense_len<=sizeof(sense_data).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1466 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 865 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 775 B | view raw |
DF-1466 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
Sense-data bcopy and HBA reqlen use sense_len without bounding to sizeof(sense_data)
Source Location
sys/dev/raid/dpt/dpt_scsi.c:858-1595
Verdict
Source-confirmed: Sense-data bcopy and HBA reqlen use sense_len without bounding to size. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
dpt_scsi.c:858 eccb->reqlen=csio->sense_len forwarded to HBA. HBA DMA-writes reqlen bytes into 32-byte sense_data -> overflows into CCB fields. :1594 bcopy(sense_len) from 32B source to 32B dest. sense_len u8 max 255. Sibling of DF-1454 sense overflow pattern. Latent (standard periphs use 32). Fix: clamp sense_len<=sizeof(sense_data).
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: dpt_scsi eccb->reqlen set to csio->sense_len without bounding to sizeof(sense_data), HBA reqlen overflows sense buffer. Added imin(sizeof(struct scsi_sense_data)) bound. HW-gated.
Verified recommended fix
Source-confirmed: dpt_scsi eccb->reqlen set to csio->sense_len without bounding to sizeof(sense_data), HBA reqlen overflows sense buffer. Added imin(sizeof(struct scsi_sense_data)) bound. HW-gated.
Verdict
Source-confirmed: dpt_scsi eccb->reqlen set to csio->sense_len without bounding to sizeof(sense_data), HBA reqlen overflows sense buffer. Added imin(sizeof(struct scsi_sense_data)) bound. HW-gated.
No comments yet.