Patch "scsi: qla2xxx: Fix an integer overflow in sysfs code" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

scsi: qla2xxx: Fix an integer overflow in sysfs code

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Carpenter <[email protected]>
Date: Wed, 30 Aug 2017 16:30:35 +0300
Subject: scsi: qla2xxx: Fix an integer overflow in sysfs code

From: Dan Carpenter <[email protected]>

commit e6f77540c067b48dee10f1e33678415bfcc89017 upstream.

The value of "size" comes from the user. When we add "start + size" it could lead to an integer overflow bug.

It means we vmalloc() a lot more memory than we had intended. I believe that on 64 bit systems vmalloc() can succeed even if we ask it to allocate huge 4GB buffers. So we would get memory corruption and likely a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().

Only root can trigger this bug.

---
 drivers/scsi/qla2xxx/qla_attr.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -404,6 +404,8 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		return -EINVAL;
 	if (start > ha->optrom_size)
 		return -EINVAL;
+	if (size > ha->optrom_size - start)
+		size = ha->optrom_size - start;
 
 	mutex_lock(&ha->optrom_mutex);
 	switch (val) {

@@ -429,8 +431,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		}
 
 		ha->optrom_region_start = start;
-		ha->optrom_region_size = start + size > ha->optrom_size ?
-		    ha->optrom_size - start : size;
+		ha->optrom_region_size = start + size;
 
 		ha->optrom_state = QLA_SREADING;
 		ha->optrom_buffer = vmalloc(ha->optrom_region_size);

@@ -503,8 +504,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		}
 
 		ha->optrom_region_start = start;
-		ha->optrom_region_size = start + size > ha->optrom_size ?
-		    ha->optrom_size - start : size;
+		ha->optrom_region_size = start + size;
 
 		ha->optrom_state = QLA_SWRITING;
 		ha->optrom_buffer = vmalloc(ha->optrom_region_size);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/scsi-sg-off-by-one-in-sg_ioctl.patch queue-4.4/scsi-qla2xxx-fix-an-integer-overflow-in-sysfs-code.patch