Re: [PATCH] scsi: qla2xxx: Fix an integer overflow in sysfs code

From: Greg KH <greg@kroah.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: qla2xxx-upstream@qlogic.com, shqking <shqking@gmail.com>,
	Joe Carnuccio <joe.carnuccio@qlogic.com>,
	"James E.J. Bottomley" <jejb@linux.vnet.ibm.com>,
	"Martin K. Petersen" <martin.petersen@oracle.com>,
	linux-scsi@vger.kernel.org, security@kernel.org
Subject: Re: [PATCH] scsi: qla2xxx: Fix an integer overflow in sysfs code
Date: Wed, 30 Aug 2017 15:12:35 +0200	[thread overview]
Message-ID: <20170830131235.GC12924@kroah.com> (raw)
In-Reply-To: <20170830122106.dmdfril4kwi4p5e5@mwanda>

On Wed, Aug 30, 2017 at 03:21:07PM +0300, Dan Carpenter wrote:
> The value of "size" comes from the user.  When we add "start + size"
> it could lead to an integer overflow bug.
> 
> It means we vmalloc() a lot more memory than we had intended.  I believe
> that on 64 bit systems vmalloc() can succeed even if we ask it to
> allocate huge 4GB buffers.  So we would get memory corruption and likely
> a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().
> 
> Only root can trigger this bug.
> 
> Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
> Reported-by: shqking <shqking@gmail.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Cc: stable <stable@vger.kernel.org>

perhaps?

thanks,

greg k-h