* [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
@ 2018-01-25 14:27 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2018-01-25 14:27 UTC (permalink / raw)
To: Sathya Prakash
Cc: Chaitra P B, Suganath Prabu Subramani, MPT-FusionLinux.pdl,
linux-scsi, kernel-janitors
My static checker complains about an out of bounds read:
drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
error: buffer overflow 'hd->sel_timeout' 255 <= u32max.
It's true that we probably should have a bounds check here.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index 8d12017b9893..4470630dd545 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2687,6 +2687,8 @@ mptctl_hp_targetinfo(unsigned long arg)
__FILE__, __LINE__, iocnum);
return -ENODEV;
}
+ if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+ return -EINVAL;
dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
ioc->name));
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
@ 2018-01-25 14:27 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2018-01-25 14:27 UTC (permalink / raw)
To: Sathya Prakash
Cc: Chaitra P B, Suganath Prabu Subramani, MPT-FusionLinux.pdl,
linux-scsi, kernel-janitors
My static checker complains about an out of bounds read:
drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
error: buffer overflow 'hd->sel_timeout' 255 <= u32max.
It's true that we probably should have a bounds check here.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index 8d12017b9893..4470630dd545 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2687,6 +2687,8 @@ mptctl_hp_targetinfo(unsigned long arg)
__FILE__, __LINE__, iocnum);
return -ENODEV;
}
+ if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+ return -EINVAL;
dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
ioc->name));
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
2018-01-25 14:27 ` Dan Carpenter
@ 2018-01-29 14:57 ` Johannes Thumshirn
-1 siblings, 0 replies; 6+ messages in thread
From: Johannes Thumshirn @ 2018-01-29 14:57 UTC (permalink / raw)
To: Dan Carpenter
Cc: Sathya Prakash, Chaitra P B, Suganath Prabu Subramani,
MPT-FusionLinux.pdl, linux-scsi, kernel-janitors
Looks good,
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
--
Johannes Thumshirn Storage
jthumshirn@suse.de +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
@ 2018-01-29 14:57 ` Johannes Thumshirn
0 siblings, 0 replies; 6+ messages in thread
From: Johannes Thumshirn @ 2018-01-29 14:57 UTC (permalink / raw)
To: Dan Carpenter
Cc: Sathya Prakash, Chaitra P B, Suganath Prabu Subramani,
MPT-FusionLinux.pdl, linux-scsi, kernel-janitors
Looks good,
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
--
Johannes Thumshirn Storage
jthumshirn@suse.de +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
2018-01-25 14:27 ` Dan Carpenter
@ 2018-01-31 2:32 ` Martin K. Petersen
-1 siblings, 0 replies; 6+ messages in thread
From: Martin K. Petersen @ 2018-01-31 2:32 UTC (permalink / raw)
To: Dan Carpenter
Cc: Sathya Prakash, Chaitra P B, Suganath Prabu Subramani,
MPT-FusionLinux.pdl, linux-scsi, kernel-janitors
Dan,
> My static checker complains about an out of bounds read:
>
> drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
> error: buffer overflow 'hd->sel_timeout' 255 <= u32max.
>
> It's true that we probably should have a bounds check here.
Applied to 4.16/scsi-fixes, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
@ 2018-01-31 2:32 ` Martin K. Petersen
0 siblings, 0 replies; 6+ messages in thread
From: Martin K. Petersen @ 2018-01-31 2:32 UTC (permalink / raw)
To: Dan Carpenter
Cc: Sathya Prakash, Chaitra P B, Suganath Prabu Subramani,
MPT-FusionLinux.pdl, linux-scsi, kernel-janitors
Dan,
> My static checker complains about an out of bounds read:
>
> drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
> error: buffer overflow 'hd->sel_timeout' 255 <= u32max.
>
> It's true that we probably should have a bounds check here.
Applied to 4.16/scsi-fixes, thanks!
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-01-31 2:44 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-01-25 14:27 [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo() Dan Carpenter
2018-01-25 14:27 ` Dan Carpenter
2018-01-29 14:57 ` Johannes Thumshirn
2018-01-29 14:57 ` Johannes Thumshirn
2018-01-31 2:32 ` Martin K. Petersen
2018-01-31 2:32 ` Martin K. Petersen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.