From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753094Ab3LMRn0 (ORCPT ); Fri, 13 Dec 2013 12:43:26 -0500 Received: from mail-ee0-f54.google.com ([74.125.83.54]:49103 "EHLO mail-ee0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752119Ab3LMRnZ (ORCPT ); Fri, 13 Dec 2013 12:43:25 -0500 Message-ID: <52AB4739.4010006@linux.com> Date: Fri, 13 Dec 2013 18:43:21 +0100 From: Levente Kurusa Reply-To: Levente Kurusa User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.1.0 MIME-Version: 1.0 To: Yu Chen CC: linux-kernel@vger.kernel.org, megaraidlinux@lsi.com, xiaoqixue_1 , =?UTF-8?B?6IyD5paH6Imv?= Subject: Re: [PATCH] scsi: integer overflow in megadev_ioctl() References: <52AB3D86.2040706@linux.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12/13/2013 06:31 PM, Yu Chen wrote: > Thank you! The new patch > ------------------------------------------------------------- > [PATCH] scsi: integer overflow in megadev_ioctl() > > There is a potential integer overflow in megadev_ioctl() if > userspace passes in a large u32 variable uioc.adapno. > Theint variable adapno would < 0, leading to a error Typo here, 'theint' should be 'the int' also it should be 'an error' instead of 'a error' > array access for hdb_soft_state[adapno], or a error Here as well. > copy_to_user(uioc.uioc_uaddr, mcontroller+adapno,..) > > Reported-by: Wenliang Fan > Suggested-by: Qixue Xiao > Signed-off-by: Yu Chen Reviewed-by: Levente Kurusa (Once you have fixed my suggestions :-) ) > --- > drivers/scsi/megaraid.c | 16 ++++++++++++---- > 1 file changed, 12 insertions(+), 4 deletions(-) > > diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c > index 41bbc21..0b90c54 100644 > --- a/drivers/scsi/megaraid.c > +++ b/drivers/scsi/megaraid.c > @@ -3099,7 +3099,10 @@ megadev_ioctl(struct file *filep, unsigned int > cmd, unsigned long arg) > /* > * Which adapter > */ > - if( (adapno = GETADAP(uioc.adapno)) >= hba_count ) > + adapno = GETADAP(uioc.adapno); > + if( adapno < 0 ) > + return (-EINVAL); > + if( adapno >= hba_count ) > return (-ENODEV); > > if( copy_to_user(uioc.uioc_uaddr, mcontroller+adapno, Total whitespace damage. :-) Try sending them with 'git send-email' or configure your email client properly. Oh, and one last thing. Don't post the v3 as a reply to this, but instead as a whole new post. -- Regards, Levente Kurusa