Re: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Sep 23, 2016 at 01:22:26PM +0200, Borislav Petkov wrote:
> On Thu, Sep 15, 2016 at 09:59:01AM -0400, Martin K. Petersen wrote:
> > >>>>> "Dan" == Dan Carpenter <dan.carpenter@xxxxxxxxxx> writes:
> > 
> > Dan> We need to put an upper bound on "user_len" so the memcpy() doesn't
> > Dan> overflow.
> > 
> > Applied to 4.9/scsi-queue.
> 
> Yap, Tomas said the kfree was missing on the error path but can we
> simplify this further by doing the user_len check first so that the
> kfree() is not even needed?
> 
> Patch ontop:
> 
> ---
> From: Borislav Petkov <bp@xxxxxxx>
> Date: Fri, 23 Sep 2016 13:04:51 +0200
> Subject: [PATCH] scsi: arcmsr: Simplify user_len checking
> 
> Do the user_len check first and then the ver_addr allocation so that
> we can save us the kfree() on the error path when user_len is >
> ARCMSR_API_DATA_BUFLEN.
> 
> Signed-off-by: Borislav Petkov <bp@xxxxxxx>
> Cc: Marco Grassi <marco.gra@xxxxxxxxx>
> Cc: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Cc: Tomas Henzl <thenzl@xxxxxxxxxx>
> Cc: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
> ---

Looks good to me,
Reviewed-by: Johannes Thumshirn <jthumshirn@xxxxxxx>

-- 
Johannes Thumshirn                                          Storage
jthumshirn@xxxxxxx                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux