linux/drivers/message/fusion
Dan Carpenter 654484aa13 mptfusion: prevent some memory corruption
[ Upstream commit e819cdb198 ]

These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz".  We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2015-12-03 10:04:59 -05:00
..
lsi SCSI updates for post 3.2 merge window 2012-01-10 10:36:08 -08:00
Kconfig scsi: use 'depends' instead of 'select' for SCSI_FC_ATTRS 2014-09-16 16:55:55 -04:00
Makefile message: change to new flag variable 2011-03-17 14:05:34 +01:00
mptbase.c fusion: fix excess parameter kernel-doc warning 2014-09-16 09:09:49 -07:00
mptbase.h mptfusion: make adapter prod_name[] a pointer 2014-07-25 17:16:58 -04:00
mptctl.c mptfusion: prevent some memory corruption 2015-12-03 10:04:59 -05:00
mptctl.h [SCSI] mpt fusion : Updated copyright statment with 2008 included 2008-06-05 09:27:17 -05:00
mptdebug.h [SCSI] mpt fusion: Fixing 1078 data corruption issue for 36GB memory region 2009-06-09 17:21:31 -05:00
mptfc.c mptfusion: remove redundant kfree checks 2014-07-25 17:16:57 -04:00
mptlan.c [SCSI] mptfusion: Extra debug prints added relavent to Device missing delay error handling 2010-07-28 09:07:47 -05:00
mptlan.h tokenring: delete all remaining driver support 2012-05-15 20:23:16 -04:00
mptsas.c mptfusion: tweak null pointer checks 2014-07-25 17:16:58 -04:00
mptsas.h mptfusion: combine fw_event_work and its event_data 2014-07-25 17:16:58 -04:00
mptscsih.c mptfusion: tweak null pointer checks 2014-07-25 17:16:58 -04:00
mptscsih.h scsi: use 64-bit LUNs 2014-07-17 22:07:37 +02:00
mptspi.c mptfusion: enable no_write_same for vmware scsi disks 2014-09-25 14:24:48 +02:00