kernel-janitors.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
@ 2018-01-25 14:27 Dan Carpenter
  2018-01-29 14:57 ` Johannes Thumshirn
  2018-01-31  2:32 ` Martin K. Petersen
  0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2018-01-25 14:27 UTC (permalink / raw)
  To: Sathya Prakash
  Cc: Chaitra P B, Suganath Prabu Subramani, MPT-FusionLinux.pdl,
	linux-scsi, kernel-janitors

My static checker complains about an out of bounds read:

    drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
    error: buffer overflow 'hd->sel_timeout' 255 <= u32max.

It's true that we probably should have a bounds check here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index 8d12017b9893..4470630dd545 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2687,6 +2687,8 @@ mptctl_hp_targetinfo(unsigned long arg)
 				__FILE__, __LINE__, iocnum);
 		return -ENODEV;
 	}
+	if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+		return -EINVAL;
 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
 	    ioc->name));
 

^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
  2018-01-25 14:27 [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo() Dan Carpenter
@ 2018-01-29 14:57 ` Johannes Thumshirn
  2018-01-31  2:32 ` Martin K. Petersen
  1 sibling, 0 replies; 3+ messages in thread
From: Johannes Thumshirn @ 2018-01-29 14:57 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Sathya Prakash, Chaitra P B, Suganath Prabu Subramani,
	MPT-FusionLinux.pdl, linux-scsi, kernel-janitors

Looks good,
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
-- 
Johannes Thumshirn                                          Storage
jthumshirn@suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo()
  2018-01-25 14:27 [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo() Dan Carpenter
  2018-01-29 14:57 ` Johannes Thumshirn
@ 2018-01-31  2:32 ` Martin K. Petersen
  1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2018-01-31  2:32 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Sathya Prakash, Chaitra P B, Suganath Prabu Subramani,
	MPT-FusionLinux.pdl, linux-scsi, kernel-janitors


Dan,

> My static checker complains about an out of bounds read:
>
>     drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
>     error: buffer overflow 'hd->sel_timeout' 255 <= u32max.
>
> It's true that we probably should have a bounds check here.

Applied to 4.16/scsi-fixes, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2018-01-31  2:32 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-01-25 14:27 [PATCH] mptfusion: Add bounds check in mptctl_hp_targetinfo() Dan Carpenter
2018-01-29 14:57 ` Johannes Thumshirn
2018-01-31  2:32 ` Martin K. Petersen

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).