From: Levente Kurusa <levex@linux.com>
To: Yu Chen <chyyuu@gmail.com>
Cc: linux-kernel@vger.kernel.org, megaraidlinux@lsi.com,
xiaoqixue_1 <xiaoqixue_1@163.com>, 范文良 <fanwlexca@gmail.com>
Subject: Re: [PATCH] scsi: integer overflow in megadev_ioctl()
Date: Fri, 13 Dec 2013 18:43:21 +0100 [thread overview]
Message-ID: <52AB4739.4010006@linux.com> (raw)
In-Reply-To: <CAAdffVHtRc4Ew9f8DMdQf7jC3+saSg1V6OVoAChhMN2WpCo2OA@mail.gmail.com>
On 12/13/2013 06:31 PM, Yu Chen wrote:
> Thank you! The new patch
> -------------------------------------------------------------
> [PATCH] scsi: integer overflow in megadev_ioctl()
>
> There is a potential integer overflow in megadev_ioctl() if
> userspace passes in a large u32 variable uioc.adapno.
> Theint variable adapno would < 0, leading to a error
Typo here, 'theint' should be 'the int'
also it should be 'an error' instead of 'a error'
> array access for hdb_soft_state[adapno], or a error
Here as well.
> copy_to_user(uioc.uioc_uaddr, mcontroller+adapno,..)
>
> Reported-by: Wenliang Fan <fanwlexca@gmail.com>
> Suggested-by: Qixue Xiao <xiaoqixue_1@163.com>
> Signed-off-by: Yu Chen <chyyuu@gmail.com>
Reviewed-by: Levente Kurusa <levex@linux.com>
(Once you have fixed my suggestions :-) )
> ---
> drivers/scsi/megaraid.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
> index 41bbc21..0b90c54 100644
> --- a/drivers/scsi/megaraid.c
> +++ b/drivers/scsi/megaraid.c
> @@ -3099,7 +3099,10 @@ megadev_ioctl(struct file *filep, unsigned int
> cmd, unsigned long arg)
> /*
> * Which adapter
> */
> - if( (adapno = GETADAP(uioc.adapno)) >= hba_count )
> + adapno = GETADAP(uioc.adapno);
> + if( adapno < 0 )
> + return (-EINVAL);
> + if( adapno >= hba_count )
> return (-ENODEV);
>
> if( copy_to_user(uioc.uioc_uaddr, mcontroller+adapno,
Total whitespace damage. :-)
Try sending them with 'git send-email' or configure your email client
properly.
Oh, and one last thing. Don't post the v3 as a reply to this, but
instead as a whole new post.
--
Regards,
Levente Kurusa
next prev parent reply other threads:[~2013-12-13 17:43 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-13 16:55 [PATCH] scsi: integer overflow in megadev_ioctl() Yu Chen
2013-12-13 17:01 ` Levente Kurusa
2013-12-13 17:31 ` Yu Chen
2013-12-13 17:43 ` Levente Kurusa [this message]
2013-12-13 18:41 Chen.Yu
2013-12-13 18:59 ` Måns Rullgård
2013-12-14 0:35 ` Yu Chen
2013-12-14 0:51 Chen.Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52AB4739.4010006@linux.com \
--to=levex@linux.com \
--cc=chyyuu@gmail.com \
--cc=fanwlexca@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=megaraidlinux@lsi.com \
--cc=xiaoqixue_1@163.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.