diff mbox

[1/2] scsi: aacraid: reading out of bounds

Message ID 20170725194955.dd4g6msevoesty4t@mwanda (mailing list archive)
State Accepted, archived
Headers show

Commit Message

Dan Carpenter July 25, 2017, 7:49 p.m. UTC 
"qd.id" comes directly from the copy_from_user() on the line before so
we should verify that it's within bounds.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This bug predates git.

Comments

Martin K. Petersen July 27, 2017, 2:10 a.m. UTC | #1 
Dan,

> "qd.id" comes directly from the copy_from_user() on the line before so
> we should verify that it's within bounds.

Applied to 4.13/scsi-fixes. Thanks!
Dave Carroll July 27, 2017, 4:12 p.m. UTC | #2 
> 
> Dan,
> 
> > "qd.id" comes directly from the copy_from_user() on the line before so
> > we should verify that it's within bounds.
> 
> Applied to 4.13/scsi-fixes. Thanks!
> 
> --
> Martin K. Petersen      Oracle Linux Engineering

Acked-by: Dave Carroll <david.carroll@microsemi.com>
diff mbox

Patch

diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 707ee2f5954d..4591113c49de 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -3198,10 +3198,11 @@  static int query_disk(struct aac_dev *dev, void __user *arg)
 		return -EBUSY;
 	if (copy_from_user(&qd, arg, sizeof (struct aac_query_disk)))
 		return -EFAULT;
-	if (qd.cnum == -1)
+	if (qd.cnum == -1) {
+		if (qd.id < 0 || qd.id >= dev->maximum_num_containers)
+			return -EINVAL;
 		qd.cnum = qd.id;
-	else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1))
-	{
+	} else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) {
 		if (qd.cnum < 0 || qd.cnum >= dev->maximum_num_containers)
 			return -EINVAL;
 		qd.instance = dev->scsi_host_ptr->host_no;