David Binderman pointed out in this post:
http://marc.info/?l=linux-scsi&m=141924469523474&w=2
a sanity check that was flawed. See attached fix. Should
be applied to lk 3.19.0-rc1 and Christoph's branches.
ChangeLog:
fix alloc_len sanity check in resp_rsup_opcodes()
---
drivers/scsi/scsi_debug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Signed-off-by: Douglas Gilbert <dgilbert@xxxxxxxxxxxx>
>From 89e7ac4920ef22943fe94112221ab3760dc3f763 Mon Sep 17 00:00:00 2001
From: Douglas Gilbert <dgilbert@xxxxxxxxxxxx>
Date: Mon, 22 Dec 2014 10:16:55 -0500
Subject: [PATCH] scsi_debug sanity check in resp_rsup_opcodes
fix alloc_len sanity check in resp_rsup_opcodes()
---
drivers/scsi/scsi_debug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 7b8b51b..63a2e1f 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1623,7 +1623,7 @@ resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
req_opcode = cmd[3];
req_sa = get_unaligned_be16(cmd + 4);
alloc_len = get_unaligned_be32(cmd + 6);
- if (alloc_len < 4 && alloc_len > 0xffff) {
+ if (alloc_len < 4 || alloc_len > 0xffff) {
mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
return check_condition_result;
}
--
1.9.1
