Messages in this thread Patch in this message | | | Date | Sun, 03 Jan 2016 16:05:45 +1100 | From | Finn Thain <> | Subject | [PATCH v4 44/78] ncr5380: Fix off-by-one bug in extended_msg[] bounds check |
| |
Fix the array bounds check when transferring an extended message from the target.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Reviewed-by: Hannes Reinecke <hare@suse.com> Tested-by: Ondrej Zary <linux@rainbow-software.org> Tested-by: Michael Schmitz <schmitzmic@gmail.com>
--- drivers/scsi/NCR5380.c | 3 ++- drivers/scsi/atari_NCR5380.c | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-)
Index: linux/drivers/scsi/NCR5380.c =================================================================== --- linux.orig/drivers/scsi/NCR5380.c 2016-01-03 16:03:57.000000000 +1100 +++ linux/drivers/scsi/NCR5380.c 2016-01-03 16:03:59.000000000 +1100 @@ -2039,7 +2039,8 @@ static void NCR5380_information_transfer dprintk(NDEBUG_EXTENDED, "scsi%d : length=%d, code=0x%02x\n", instance->host_no, (int) extended_msg[1], (int) extended_msg[2]); - if (!len && extended_msg[1] <= (sizeof(extended_msg) - 1)) { + if (!len && extended_msg[1] > 0 && + extended_msg[1] <= sizeof(extended_msg) - 2) { /* Accept third byte by clearing ACK */ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE); len = extended_msg[1] - 1; Index: linux/drivers/scsi/atari_NCR5380.c =================================================================== --- linux.orig/drivers/scsi/atari_NCR5380.c 2016-01-03 16:03:57.000000000 +1100 +++ linux/drivers/scsi/atari_NCR5380.c 2016-01-03 16:03:59.000000000 +1100 @@ -2330,8 +2330,8 @@ static void NCR5380_information_transfer dprintk(NDEBUG_EXTENDED, "scsi%d: length=%d, code=0x%02x\n", HOSTNO, (int)extended_msg[1], (int)extended_msg[2]); - if (!len && extended_msg[1] <= - (sizeof(extended_msg) - 1)) { + if (!len && extended_msg[1] > 0 && + extended_msg[1] <= sizeof(extended_msg) - 2) { /* Accept third byte by clearing ACK */ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE); len = extended_msg[1] - 1;
| |