Files
linux/drivers/scsi
Mahesh Rajashekhara 0417642d65 aacraid: prevent invalid pointer dereference
commit b4789b8e6b upstream.

It appears that driver runs into a problem here if fibsize is too small
because we allocate user_srbcmd with fibsize size only but later we
access it until user_srbcmd->sg.count to copy it over to srbcmd.

It is not correct to test (fibsize < sizeof(*user_srbcmd)) because this
structure already includes one sg element and this is not needed for
commands without data.  So, we would recommend to add the following
(instead of test for fibsize == 0).

Signed-off-by: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-29 11:11:40 -08:00
..
2013-04-09 14:13:26 -04:00
2013-04-09 14:13:27 -04:00
2011-07-26 16:49:47 -07:00
2013-06-26 23:08:22 -07:00
2013-05-10 07:53:40 -07:00
2013-04-09 14:13:21 -04:00
2013-02-22 23:31:31 -05:00
2011-03-31 11:26:23 -03:00
2013-02-22 23:31:31 -05:00
2013-02-22 23:31:31 -05:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2013-04-09 14:13:15 -04:00
2013-04-09 14:13:15 -04:00
2013-04-09 14:13:22 -04:00
2010-11-16 13:33:23 -08:00
2013-04-09 14:13:23 -04:00
2013-04-09 14:13:24 -04:00
2013-04-09 14:13:19 -04:00
2013-04-09 14:13:19 -04:00
2013-02-27 19:10:18 -08:00
2013-04-09 14:13:24 -04:00
2011-03-31 11:26:23 -03:00
2013-04-09 14:13:24 -04:00
2010-11-16 13:33:23 -08:00
2013-04-09 14:13:17 -04:00
2013-04-09 14:13:17 -04:00
2013-04-09 14:13:23 -04:00
2011-05-01 10:22:40 -05:00
2011-03-31 11:26:23 -03:00
2013-04-09 14:13:17 -04:00
2010-11-16 13:33:23 -08:00
2013-04-09 14:13:16 -04:00
2013-04-09 14:13:16 -04:00
2013-04-09 14:13:16 -04:00
2013-04-09 14:13:16 -04:00
2013-04-09 14:13:15 -04:00
2013-04-09 14:13:16 -04:00
2013-04-09 14:13:25 -04:00
2010-11-16 13:33:23 -08:00
2011-03-31 11:26:23 -03:00
2013-04-09 14:13:27 -04:00
2013-04-09 14:13:17 -04:00
2013-04-09 14:13:17 -04:00
2013-05-05 00:15:15 -04:00
2012-03-28 18:30:03 +01:00
2013-04-09 14:13:15 -04:00
2010-05-02 15:55:03 -04:00
2010-11-16 13:33:23 -08:00
2013-04-09 14:13:17 -04:00
2013-04-09 14:13:17 -04:00
2011-03-31 11:26:23 -03:00
2012-03-28 18:30:03 +01:00
2011-03-31 11:26:23 -03:00
2013-04-09 14:13:17 -04:00
2013-04-09 14:13:17 -04:00
2012-02-21 11:40:37 +01:00
2013-04-09 14:13:17 -04:00
2010-11-16 13:33:23 -08:00
2010-11-16 13:33:23 -08:00
2012-01-03 22:54:07 -05:00
2013-07-25 14:07:30 -07:00
2013-05-07 20:16:25 -07:00
2012-09-14 17:59:29 +01:00
2013-05-04 14:50:16 -04:00
2013-05-04 14:50:16 -04:00
2013-05-04 14:50:16 -04:00
2010-11-16 13:33:23 -08:00
2013-04-09 14:13:17 -04:00
2013-04-09 14:13:17 -04:00
2010-11-16 13:33:23 -08:00
2013-04-09 14:13:15 -04:00
2013-04-09 14:13:15 -04:00
2013-04-09 14:13:15 -04:00