sparc64: Properly range check DAX completion index
authorRob Gardner <rob.gardner@oracle.com>
Sun, 1 Apr 2018 04:53:01 +0000 (22:53 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 19 Apr 2018 06:54:05 +0000 (08:54 +0200)
commit032439485e56883654bcb9334eee99cdf3f5dee1
tree794cf59991bf6391d9b5f9ca5200719a870b3aae
parent2163146fd1c870c1082aa45f5f53ead0d6e51f7c
sparc64: Properly range check DAX completion index

[ Upstream commit 49d7006d9f01d435661d03bbea3db4c33935b3d8 ]

Each Oracle DAX CCB has a corresponding completion area, and the required
number of areas must fit within a previously allocated array of completion
areas beginning at the requested index.  Since the completion area index
is specified by a file offset, a user can pass arbitrary values, including
negative numbers. So the index must be thoroughly range checked to prevent
access to addresses outside the bounds of the allocated completion
area array.  The index cannot be negative, and it cannot exceed the
total array size, less the number of CCBs requested. The old code did
not check for negative values and was off by one on the upper bound.

Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Jonathan Helman <jonathan.helman@oracle.com>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/sbus/char/oradax.c