kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/scsi/aacraid
History
Dave Carroll 962b0f29a5 aacraid: Check size values after double-fetch from user 
commit fa00c437ee upstream.

In aacraid's ioctl_send_fib() we do two fetches from userspace, one the
get the fib header's size and one for the fib itself. Later we use the
size field from the second fetch to further process the fib. If for some
reason the size from the second fetch is different than from the first
fix, we may encounter an out-of- bounds access in aac_fib_send(). We
also check the sender size to insure it is not out of bounds. This was
reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was
assigned CVE-2016-6480.

Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)'
Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-11-20 01:17:07 +00:00
..
aachba.c [SCSI] aacraid: SCSI dma mapping failure case handling 2012-11-27 08:59:46 +04:00
aacraid.h [SCSI] aacraid: kdump fix 2014-03-15 10:19:00 -07:00
commctrl.c aacraid: Check size values after double-fetch from user 2016-11-20 01:17:07 +00:00
comminit.c [SCSI] aacraid: Dual firmware image support 2013-04-10 11:55:52 -07:00
commsup.c aacraid: Fix for aac_command_thread hang 2016-08-22 22:37:52 +01:00
dpcsup.c [SCSI] aacraid: Series 7 Async. (performance) mode support 2012-07-20 08:59:04 +01:00
linit.c [SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers 2013-11-29 08:48:39 +04:00
Makefile [SCSI] aacraid: Add new code for PMC-Sierra's SRC based controller family 2011-03-23 11:36:58 -05:00
nark.c [SCSI] aacraid: Use resource_size_t for IO mem pointers and offsets 2012-07-20 08:58:43 +01:00
rkt.c [SCSI] aacraid: Use resource_size_t for IO mem pointers and offsets 2012-07-20 08:58:43 +01:00
rx.c [SCSI] remove deprecated IRQF_DISABLED from SCSI 2014-03-19 15:04:44 -07:00
sa.c [SCSI] remove deprecated IRQF_DISABLED from SCSI 2014-03-19 15:04:44 -07:00
src.c [SCSI] remove deprecated IRQF_DISABLED from SCSI 2014-03-19 15:04:44 -07:00
TODO [SCSI] aacraid: Newer adapter communication iterface support 2005-10-28 11:41:53 -05:00