On Tue, 2013-10-29 at 22:10 +0300, Dan Carpenter wrote:
> If "fibsize" is zero then it leads to a ZERO_SIZE_PTR dereference when
> we dereference user_srbcmd.
>
> Due to a missing capable() check in the compat ioctls then this error
> can be triggered without CAP_SYS_RAWIO. I have fixed that in a separate
> patch.
>
> Reported-by: Nico Golde <nico@xxxxxxxxx>
> Reported-by: Fabian Yamaguchi <fabs@xxxxxxxxx>
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>
> diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
> index d85ac1a..efd0ba3 100644
> --- a/drivers/scsi/aacraid/commctrl.c
> +++ b/drivers/scsi/aacraid/commctrl.c
> @@ -511,7 +511,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
> goto cleanup;
> }
>
> - if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
> + if (fibsize == 0 ||
> + fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
Not really if you want to catch actual undersize errors. We read out of
the allocated data structure after this, so it had better be at least
sizeof(*user_srbcmd) rather than just not zero to make sure we aren't
reading off the end of the allocated size.
James
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
