Lin Ma f61fc650c4 scsi: qla4xxx: Add length check when parsing nlattrs ... [ Upstream commit 47cd3770e3 ] There are three places that qla4xxx parses nlattrs: - qla4xxx_set_chap_entry() - qla4xxx_iface_set_param() - qla4xxx_sysfs_ddb_set_param() and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data. Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails. Fixes: 26ffd7b45f ("[SCSI] qla4xxx: Add support to set CHAP entries") Fixes: 1e9e2be3ee ("[SCSI] qla4xxx: Add flash node mgmt support") Fixes: 00c31889f7 ("[SCSI] qla4xxx: fix data alignment and use nl helpers") Signed-off-by: Lin Ma <linma@zju.edu.cn> Link: https://lore.kernel.org/r/20230723080053.3714534-1-linma@zju.edu.cn Reviewed-by: Chris Leech <cleech@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-09-19 12:22:45 +02:00
..
Kconfig	…
Makefile	…
ql4_83xx.c	…
ql4_83xx.h	…
ql4_attr.c	…
ql4_bsg.c	…
ql4_bsg.h	…
ql4_dbg.c	…
ql4_dbg.h	…
ql4_def.h	…
ql4_fw.h	…
ql4_glbl.h	…
ql4_init.c	…
ql4_inline.h	…
ql4_iocb.c	…
ql4_isr.c	…
ql4_mbx.c	…
ql4_nvram.c	…
ql4_nvram.h	…
ql4_nx.c	…
ql4_nx.h	…
ql4_os.c	scsi: qla4xxx: Add length check when parsing nlattrs	2023-09-19 12:22:45 +02:00
ql4_version.h	…