projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 1cb57d8) | patch
scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 14 Dec 2016 12:24:52 +0000 (13:24 +0100)
committerSasha Levin <alexander.levin@verizon.com>
Fri, 23 Dec 2016 15:39:29 +0000 (10:39 -0500)
commit6371e0cdc5be8671461f136dc1df9a36bdb5292a
treec3148679f0b28bb62bf4d493c6366165caa5dc85tree | snapshot
parent1cb57d81cf20fe24b9e2e1daf57bfbdc24b77cd8commit | diff
scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()

[ Upstream commit 7bc2b55a5c030685b399bb65b6baa9ccc3d1f167 ]

We need to put an upper bound on "user_len" so the memcpy() doesn't
overflow.

Cc: <stable@vger.kernel.org>
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
drivers/scsi/arcmsr/arcmsr_hba.c diff | blob | history
Linux Kernel tree with some unpolished code for Colibri/Apalis modules