leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mptfusion: prevent some memory corruption

Browse Source 
These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz".  We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
This commit is contained in:
Dan Carpenter 2015-07-03 11:53:03 +03:00 committed by James Bottomley
parent 8d6a9f5676
commit e819cdb198
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/message/fusion/mptctl.c
View File

@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
} }
spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags); spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
/* Basic sanity checks to prevent underflows or integer overflows */
if (karg.maxReplyBytes < 0 ||
karg.dataInSize < 0 ||
karg.dataOutSize < 0 ||
karg.dataSgeOffset < 0 ||
karg.maxSenseBytes < 0 ||
karg.dataSgeOffset > ioc->req_sz / 4)
return -EINVAL;
/* Verify that the final request frame will not be too large. /* Verify that the final request frame will not be too large.
*/ */
sz = karg.dataSgeOffset * 4; sz = karg.dataSgeOffset * 4;