* [PATCH] snic: correctly check for array overrun on overly long version number
@ 2016-02-25 22:58 Colin King
2016-03-01 5:33 ` Seymour, Shane M
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Colin King @ 2016-02-25 22:58 UTC (permalink / raw)
To: Narsimhulu Musini, Sesidhar Baddela, James E . J . Bottomley,
Martin K . Petersen, linux-scsi
Cc: linux-kernel
From: Colin Ian King <colin.king@canonical.com>
The snic version number is expected to be 4 decimals in the form like
a netmask string with each number stored in an element in array v.
However, there is an off-by-one check on the number of elements in v
allowing one to pass a 5 decimal version number causing v[4] to be
referenced, causing a buffer overrun. Fix the off-by-one error by
comparing to i > 3 rather than 4.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/scsi/snic/snic_ctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
index aebe753..ab0e06b 100644
--- a/drivers/scsi/snic/snic_ctl.c
+++ b/drivers/scsi/snic/snic_ctl.c
@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
continue;
}
- if (i > 4 || !isdigit(c))
+ if (i > 3 || !isdigit(c))
goto end;
v[i] = v[i] * 10 + (c - '0');
--
2.7.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* RE: [PATCH] snic: correctly check for array overrun on overly long version number
2016-02-25 22:58 [PATCH] snic: correctly check for array overrun on overly long version number Colin King
@ 2016-03-01 5:33 ` Seymour, Shane M
2016-03-01 17:29 ` Ewan Milne
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Seymour, Shane M @ 2016-03-01 5:33 UTC (permalink / raw)
To: Colin King, Narsimhulu Musini, Sesidhar Baddela,
James E . J . Bottomley, Martin K . Petersen,
linux-scsi@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Shane Seymour <shane.seymour@hpe.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] snic: correctly check for array overrun on overly long version number
2016-02-25 22:58 [PATCH] snic: correctly check for array overrun on overly long version number Colin King
2016-03-01 5:33 ` Seymour, Shane M
@ 2016-03-01 17:29 ` Ewan Milne
2016-03-02 1:09 ` Martin K. Petersen
2016-03-02 8:54 ` Narsimhulu Musini (nmusini)
3 siblings, 0 replies; 5+ messages in thread
From: Ewan Milne @ 2016-03-01 17:29 UTC (permalink / raw)
To: Colin King
Cc: Narsimhulu Musini, Sesidhar Baddela, James E . J . Bottomley,
Martin K . Petersen, linux-scsi, linux-kernel
On Thu, 2016-02-25 at 22:58 +0000, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The snic version number is expected to be 4 decimals in the form like
> a netmask string with each number stored in an element in array v.
> However, there is an off-by-one check on the number of elements in v
> allowing one to pass a 5 decimal version number causing v[4] to be
> referenced, causing a buffer overrun. Fix the off-by-one error by
> comparing to i > 3 rather than 4.
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> drivers/scsi/snic/snic_ctl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
> index aebe753..ab0e06b 100644
> --- a/drivers/scsi/snic/snic_ctl.c
> +++ b/drivers/scsi/snic/snic_ctl.c
> @@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
> continue;
> }
>
> - if (i > 4 || !isdigit(c))
> + if (i > 3 || !isdigit(c))
> goto end;
>
> v[i] = v[i] * 10 + (c - '0');
int v[4] = {0};
So clearly the i > 4 test is wrong and should be i > 3.
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] snic: correctly check for array overrun on overly long version number
2016-02-25 22:58 [PATCH] snic: correctly check for array overrun on overly long version number Colin King
2016-03-01 5:33 ` Seymour, Shane M
2016-03-01 17:29 ` Ewan Milne
@ 2016-03-02 1:09 ` Martin K. Petersen
2016-03-02 8:54 ` Narsimhulu Musini (nmusini)
3 siblings, 0 replies; 5+ messages in thread
From: Martin K. Petersen @ 2016-03-02 1:09 UTC (permalink / raw)
To: Colin King
Cc: Narsimhulu Musini, Sesidhar Baddela, James E . J . Bottomley,
Martin K . Petersen, linux-scsi, linux-kernel
>>>>> "Colin" == Colin King <colin.king@canonical.com> writes:
Colin> The snic version number is expected to be 4 decimals in the form
Colin> like a netmask string with each number stored in an element in
Colin> array v. However, there is an off-by-one check on the number of
Colin> elements in v allowing one to pass a 5 decimal version number
Colin> causing v[4] to be referenced, causing a buffer overrun. Fix the
Colin> off-by-one error by comparing to i > 3 rather than 4.
Applied to 4.6/scsi-queue.
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] snic: correctly check for array overrun on overly long version number
2016-02-25 22:58 [PATCH] snic: correctly check for array overrun on overly long version number Colin King
` (2 preceding siblings ...)
2016-03-02 1:09 ` Martin K. Petersen
@ 2016-03-02 8:54 ` Narsimhulu Musini (nmusini)
3 siblings, 0 replies; 5+ messages in thread
From: Narsimhulu Musini (nmusini) @ 2016-03-02 8:54 UTC (permalink / raw)
To: Colin King, Sesidhar Baddela (sebaddel), James E . J . Bottomley,
Martin K . Petersen, linux-scsi@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
On 26/02/16 4:28 am, "Colin King" <colin.king@canonical.com> wrote:
>From: Colin Ian King <colin.king@canonical.com>
>
>The snic version number is expected to be 4 decimals in the form like
>a netmask string with each number stored in an element in array v.
>However, there is an off-by-one check on the number of elements in v
>allowing one to pass a 5 decimal version number causing v[4] to be
>referenced, causing a buffer overrun. Fix the off-by-one error by
>comparing to i > 3 rather than 4.
Acked-by: Narsimhulu Musini <nmusini@cisco.com>
>
>Signed-off-by: Colin Ian King <colin.king@canonical.com>
>---
> drivers/scsi/snic/snic_ctl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/scsi/snic/snic_ctl.c b/drivers/scsi/snic/snic_ctl.c
>index aebe753..ab0e06b 100644
>--- a/drivers/scsi/snic/snic_ctl.c
>+++ b/drivers/scsi/snic/snic_ctl.c
>@@ -75,7 +75,7 @@ snic_ver_enc(const char *s)
> continue;
> }
>
>- if (i > 4 || !isdigit(c))
>+ if (i > 3 || !isdigit(c))
> goto end;
>
> v[i] = v[i] * 10 + (c - '0');
>--
>2.7.0
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-03-02 8:54 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-25 22:58 [PATCH] snic: correctly check for array overrun on overly long version number Colin King
2016-03-01 5:33 ` Seymour, Shane M
2016-03-01 17:29 ` Ewan Milne
2016-03-02 1:09 ` Martin K. Petersen
2016-03-02 8:54 ` Narsimhulu Musini (nmusini)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).