From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Martin K. Petersen" Subject: Re: [PATCH] scsi_debug: fix map_region and unmap_region oops Date: Mon, 28 Jun 2010 13:18:20 -0400 Message-ID: References: <20100628010219G.fujita.tomonori@lab.ntt.co.jp> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from rcsinet10.oracle.com ([148.87.113.121]:52901 "EHLO rcsinet10.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752184Ab0F1RTh (ORCPT ); Mon, 28 Jun 2010 13:19:37 -0400 In-Reply-To: <20100628010219G.fujita.tomonori@lab.ntt.co.jp> (FUJITA Tomonori's message of "Mon, 28 Jun 2010 01:04:45 +0900") Sender: linux-scsi-owner@vger.kernel.org List-Id: linux-scsi@vger.kernel.org To: FUJITA Tomonori Cc: dgilbert@interlog.com, martin.petersen@oracle.com, hch@lst.de, James.Bottomley@suse.de, linux-scsi@vger.kernel.org >>>>> "Tomo" == FUJITA Tomonori writes: Tomo> = From: FUJITA Tomonori Subject: Tomo> [PATCH] scsi_debug: fix map_region and unmap_region oops Tomo> map_region and unmap_region could access to invalid memory area Tomo> since they don't check the size boundary. Tomo> Signed-off-by: FUJITA Tomonori --- Tomo> drivers/scsi/scsi_debug.c | 6 ++++-- 1 files changed, 4 Tomo> insertions(+), 2 deletions(-) Tomo> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c Tomo> index 136329b..b02bdc6 100644 Tomo> --- a/drivers/scsi/scsi_debug.c Tomo> +++ b/drivers/scsi/scsi_debug.c Tomo> @@ -1991,7 +1991,8 @@ static void map_region(sector_t lba, Tomo> unsigned int len) Tomo> block = lba + alignment; rem = do_div(block, Tomo> granularity); Tomo> - set_bit(block, map_storep); Tomo> + if (block < map_size) Tomo> + set_bit(block, map_storep); Tomo> lba += granularity - rem; Tomo> } Tomo> @@ -2011,7 +2012,8 @@ static void unmap_region(sector_t lba, Tomo> unsigned int len) Tomo> block = lba + alignment; rem = do_div(block, Tomo> granularity); Tomo> - if (rem == 0 && lba + granularity <= end) Tomo> + if (rem == 0 && lba + granularity <= end && Tomo> + block < map_size) Tomo> clear_bit(block, map_storep); Tomo> lba += granularity - rem; I'm ok with the patch but I'm interested in what you were doing causing it to access out of bounds? -- Martin K. Petersen Oracle Linux Engineering