lkml.org 
[lkml]   [2018]   [Feb]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 023/136] scsi: bfa: integer overflow in debugfs
    3.16.54-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 3e351275655d3c84dc28abf170def9786db5176d upstream.

    We could allocate less memory than intended because we do:

    bfad->regdata = kzalloc(len << 2, GFP_KERNEL);

    The shift can overflow leading to a crash. This is debugfs code so the
    impact is very small. I fixed the network version of this in March with
    commit 13e2d5187f6b ("bna: integer overflow bug in debugfs").

    Fixes: ab2a9ba189e8 ("[SCSI] bfa: add debugfs support")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/scsi/bfa/bfad_debugfs.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/drivers/scsi/bfa/bfad_debugfs.c
    +++ b/drivers/scsi/bfa/bfad_debugfs.c
    @@ -254,7 +254,8 @@ bfad_debugfs_write_regrd(struct file *fi
    struct bfad_s *bfad = port->bfad;
    struct bfa_s *bfa = &bfad->bfa;
    struct bfa_ioc_s *ioc = &bfa->ioc;
    - int addr, len, rc, i;
    + int addr, rc, i;
    + u32 len;
    u32 *regbuf;
    void __iomem *rb, *reg_addr;
    unsigned long flags;
    @@ -274,7 +275,7 @@ bfad_debugfs_write_regrd(struct file *fi
    }

    rc = sscanf(kern_buf, "%x:%x", &addr, &len);
    - if (rc < 2) {
    + if (rc < 2 || len > (UINT_MAX >> 2)) {
    printk(KERN_INFO
    "bfad[%d]: %s failed to read user buf\n",
    bfad->inst_no, __func__);
    \
     
     \ /
      Last update: 2018-02-11 05:35    [W:4.151 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site