lkml.org 
[lkml]   [2011]   [Dec]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRE: [PATCH] SCSI: aacraid: potential integer overflow in aac_get_containers()
    Date
    From
    Acked-by: Achim Leubner <Achim_Leubner@pmc-sierra.com>


    -----Original Message-----
    From: linux-scsi-owner@vger.kernel.org
    [mailto:linux-scsi-owner@vger.kernel.org] On Behalf Of Haogang Chen
    Sent: Donnerstag, 1. Dezember 2011 03:30
    To: aacraid@adaptec.com
    Cc: JBottomley@parallels.com; linux-scsi@vger.kernel.org;
    linux-kernel@vger.kernel.org; haogangchen@gmail.com
    Subject: [PATCH] SCSI: aacraid: potential integer overflow in
    aac_get_containers()

    There is a potential integer overflow in aac_get_containers(). When
    maximum_num_containers is large, the subsequent call to kzalloc() will
    allocate a buffer smaller than expected, which leads to memory
    corruption in the for loop.

    The patch replaces kzalloc with kcalloc.

    Signed-off-by: Haogang Chen <haogangchen@gmail.com>
    ---
    drivers/scsi/aacraid/aachba.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/drivers/scsi/aacraid/aachba.c
    b/drivers/scsi/aacraid/aachba.c
    index 409f580..440b84d 100644
    --- a/drivers/scsi/aacraid/aachba.c
    +++ b/drivers/scsi/aacraid/aachba.c
    @@ -381,7 +381,7 @@ int aac_get_containers(struct aac_dev *dev)

    if (maximum_num_containers < MAXIMUM_NUM_CONTAINERS)
    maximum_num_containers = MAXIMUM_NUM_CONTAINERS;
    - fsa_dev_ptr = kzalloc(sizeof(*fsa_dev_ptr) *
    maximum_num_containers,
    + fsa_dev_ptr = kcalloc(maximum_num_containers,
    sizeof(*fsa_dev_ptr),
    GFP_KERNEL);
    if (!fsa_dev_ptr)
    return -ENOMEM;
    --
    1.7.5.4
    --
    To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html


    \
     
     \ /
      Last update: 2011-12-01 11:43    [W:3.119 / U:0.688 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site