lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 415/542] cmd64x: potential buffer overflow in cmd64x_program_timings()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 117fcc3053606d8db5cef8821dca15022ae578bb ]

    The "drive->dn" value is a u8 and it is controlled by root only, but
    it could be out of bounds here so let's check.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/ide/cmd64x.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
    index a1898e11b04e6..943bf944bf722 100644
    --- a/drivers/ide/cmd64x.c
    +++ b/drivers/ide/cmd64x.c
    @@ -66,6 +66,9 @@ static void cmd64x_program_timings(ide_drive_t *drive, u8 mode)
    struct ide_timing t;
    u8 arttim = 0;

    + if (drive->dn >= ARRAY_SIZE(drwtim_regs))
    + return;
    +
    ide_timing_compute(drive, mode, &t, T, 0);

    /*
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 18:54    [W:2.121 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site