| Message ID | 20160215190123.11294.22634.stgit@localhost.localdomain (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Headers | show |
On Mon, Feb 15, 2016 at 07:01:29PM +0000, Alan wrote: > Check the array size *before* dereferencing it with a user provided offset > > Signed-off-by: Alan Cox <alan@linux.intel.com> > --- > drivers/scsi/esas2r/esas2r_ioctl.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/esas2r/esas2r_ioctl.c b/drivers/scsi/esas2r/esas2r_ioctl.c > index baf9130..3e84834 100644 > --- a/drivers/scsi/esas2r/esas2r_ioctl.c > +++ b/drivers/scsi/esas2r/esas2r_ioctl.c > @@ -1360,14 +1360,15 @@ int esas2r_ioctl_handler(void *hostdata, int cmd, void __user *arg) > if (ioctl->header.channel == 0xFF) { > a = (struct esas2r_adapter *)hostdata; > } else { > - a = esas2r_adapters[ioctl->header.channel]; > - if (ioctl->header.channel >= MAX_ADAPTERS || (a == NULL)) { > + if (ioctl->header.channel >= MAX_ADAPTERS || > + esas2r_adapters[ioctl->header.channel] == NULL) { > ioctl->header.return_code = IOCTL_BAD_CHANNEL; > esas2r_log(ESAS2R_LOG_WARN, "bad channel value"); > kfree(ioctl); > > return -ENOTSUPP; > } > + a = esas2r_adapters[ioctl->header.channel]; > } > > switch (cmd) { > > -- > To unsubscribe from this list: send the line "unsubscribe linux-scsi" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
On 15.2.2016 20:01, Alan wrote: > Check the array size *before* dereferencing it with a user provided offset > > Signed-off-by: Alan Cox <alan@linux.intel.com> Reviewed-by: Tomas Henzl <thenzl@redhat.com> Tomas -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
>>>>> "Alan" == Alan <gnomes@lxorguk.ukuu.org.uk> writes:
Alan> Check the array size *before* dereferencing it with a user
Alan> provided offset
Applied to 4.6/scsi-queue.
diff --git a/drivers/scsi/esas2r/esas2r_ioctl.c b/drivers/scsi/esas2r/esas2r_ioctl.c index baf9130..3e84834 100644 --- a/drivers/scsi/esas2r/esas2r_ioctl.c +++ b/drivers/scsi/esas2r/esas2r_ioctl.c @@ -1360,14 +1360,15 @@ int esas2r_ioctl_handler(void *hostdata, int cmd, void __user *arg) if (ioctl->header.channel == 0xFF) { a = (struct esas2r_adapter *)hostdata; } else { - a = esas2r_adapters[ioctl->header.channel]; - if (ioctl->header.channel >= MAX_ADAPTERS || (a == NULL)) { + if (ioctl->header.channel >= MAX_ADAPTERS || + esas2r_adapters[ioctl->header.channel] == NULL) { ioctl->header.return_code = IOCTL_BAD_CHANNEL; esas2r_log(ESAS2R_LOG_WARN, "bad channel value"); kfree(ioctl); return -ENOTSUPP; } + a = esas2r_adapters[ioctl->header.channel]; } switch (cmd) {
Check the array size *before* dereferencing it with a user provided offset Signed-off-by: Alan Cox <alan@linux.intel.com> --- drivers/scsi/esas2r/esas2r_ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html