diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-07-03 11:53:03 +0300 |
---|---|---|
committer | James Bottomley <JBottomley@Odin.com> | 2015-08-26 07:11:45 -0700 |
commit | e819cdb198319cccf4af4fc12ac4d796109d8c23 (patch) | |
tree | 5ebde58eb5e51eb6dc52149192e00ff9a13275e4 /drivers/message | |
parent | 8d6a9f5676f0e734967ac3739f5c6a28a0b047d9 (diff) | |
download | op-kernel-dev-e819cdb198319cccf4af4fc12ac4d796109d8c23.zip op-kernel-dev-e819cdb198319cccf4af4fc12ac4d796109d8c23.tar.gz |
mptfusion: prevent some memory corruption
These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.
We use "karg.dataSgeOffset" to calculate "sz". We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Diffstat (limited to 'drivers/message')
-rw-r--r-- | drivers/message/fusion/mptctl.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c index 70bb753..fc73937 100644 --- a/drivers/message/fusion/mptctl.c +++ b/drivers/message/fusion/mptctl.c @@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr) } spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags); + /* Basic sanity checks to prevent underflows or integer overflows */ + if (karg.maxReplyBytes < 0 || + karg.dataInSize < 0 || + karg.dataOutSize < 0 || + karg.dataSgeOffset < 0 || + karg.maxSenseBytes < 0 || + karg.dataSgeOffset > ioc->req_sz / 4) + return -EINVAL; + /* Verify that the final request frame will not be too large. */ sz = karg.dataSgeOffset * 4; |