lkml.org 
[lkml]   [2016]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH v4 44/78] ncr5380: Fix off-by-one bug in extended_msg[] bounds check
    Fix the array bounds check when transferring an extended message from the
    target.

    Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
    Reviewed-by: Hannes Reinecke <hare@suse.com>
    Tested-by: Ondrej Zary <linux@rainbow-software.org>
    Tested-by: Michael Schmitz <schmitzmic@gmail.com>

    ---
    drivers/scsi/NCR5380.c | 3 ++-
    drivers/scsi/atari_NCR5380.c | 4 ++--
    2 files changed, 4 insertions(+), 3 deletions(-)

    Index: linux/drivers/scsi/NCR5380.c
    ===================================================================
    --- linux.orig/drivers/scsi/NCR5380.c 2016-01-03 16:03:57.000000000 +1100
    +++ linux/drivers/scsi/NCR5380.c 2016-01-03 16:03:59.000000000 +1100
    @@ -2039,7 +2039,8 @@ static void NCR5380_information_transfer

    dprintk(NDEBUG_EXTENDED, "scsi%d : length=%d, code=0x%02x\n", instance->host_no, (int) extended_msg[1], (int) extended_msg[2]);

    - if (!len && extended_msg[1] <= (sizeof(extended_msg) - 1)) {
    + if (!len && extended_msg[1] > 0 &&
    + extended_msg[1] <= sizeof(extended_msg) - 2) {
    /* Accept third byte by clearing ACK */
    NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
    len = extended_msg[1] - 1;
    Index: linux/drivers/scsi/atari_NCR5380.c
    ===================================================================
    --- linux.orig/drivers/scsi/atari_NCR5380.c 2016-01-03 16:03:57.000000000 +1100
    +++ linux/drivers/scsi/atari_NCR5380.c 2016-01-03 16:03:59.000000000 +1100
    @@ -2330,8 +2330,8 @@ static void NCR5380_information_transfer
    dprintk(NDEBUG_EXTENDED, "scsi%d: length=%d, code=0x%02x\n", HOSTNO,
    (int)extended_msg[1], (int)extended_msg[2]);

    - if (!len && extended_msg[1] <=
    - (sizeof(extended_msg) - 1)) {
    + if (!len && extended_msg[1] > 0 &&
    + extended_msg[1] <= sizeof(extended_msg) - 2) {
    /* Accept third byte by clearing ACK */
    NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
    len = extended_msg[1] - 1;



    \
     
     \ /
      Last update: 2016-01-03 07:01    [W:2.617 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site