lkml.org 
[lkml]   [2014]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 019/103] SCSI: megaraid: missing bounds check in mimd_to_kioc()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 3de2260140417759c669d391613d583baf03b0cf upstream.

    pthru32->dataxferlen comes from the user so we need to check that it's
    not too large so we don't overflow the buffer.

    Reported-by: Nico Golde <nico@ngolde.de>
    Reported-by: Fabian Yamaguchi <fabs@goesec.de>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Sumit Saxena <sumit.saxena@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    drivers/scsi/megaraid/megaraid_mm.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
    index dfffd0f37916..a70692779a16 100644
    --- a/drivers/scsi/megaraid/megaraid_mm.c
    +++ b/drivers/scsi/megaraid/megaraid_mm.c
    @@ -486,6 +486,8 @@ mimd_to_kioc(mimd_t __user *umimd, mraid_mmadp_t *adp, uioc_t *kioc)

    pthru32->dataxferaddr = kioc->buf_paddr;
    if (kioc->data_dir & UIOC_WR) {
    + if (pthru32->dataxferlen > kioc->xferlen)
    + return -EINVAL;
    if (copy_from_user(kioc->buf_vaddr, kioc->user_data,
    pthru32->dataxferlen)) {
    return (-EFAULT);
    --
    1.9.3


    \
     
     \ /
      Last update: 2014-05-29 17:21    [W:7.742 / U:0.588 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site