Hi Sasha,
On Sat, Dec 12, 2020 at 11:07:56AM -0500, Sasha Levin wrote:
From: "Andrea Parri (Microsoft)" parri.andrea@gmail.com
[ Upstream commit 3b8c72d076c42bf27284cda7b2b2b522810686f8 ]
FYI, we found that this commit introduced a regression and posted a revert:
https://lkml.kernel.org/r/20201211131404.21359-1-parri.andrea@gmail.com
Same comment for the AUTOSEL 5.4, 4.19 and 4.14 you've just posted.
Andrea
Check that the packet is of the expected size at least, don't copy data past the packet.
Link: https://lore.kernel.org/r/20201118145348.109879-1-parri.andrea@gmail.com Cc: "James E.J. Bottomley" jejb@linux.ibm.com Cc: "Martin K. Petersen" martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org Reported-by: Saruhan Karademir skarade@microsoft.com Signed-off-by: Andrea Parri (Microsoft) parri.andrea@gmail.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org
drivers/scsi/storvsc_drv.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 8f5f5dc863a4a..6779ee4edfee3 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1246,6 +1246,11 @@ static void storvsc_on_channel_callback(void *context) request = (struct storvsc_cmd_request *) ((unsigned long)desc->trans_id);
if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) - vmscsi_size_delta) {
dev_err(&device->device, "Invalid packet len\n");
continue;
}
- if (request == &stor_device->init_request || request == &stor_device->reset_request) { memcpy(&request->vstor_packet, packet,
-- 2.27.0