Skip to contentSkip to conversation

ipr: Read buffer overflow

PATCH In review Roel Kluin 2 participants 2 messages Aug 7, 2009

Subsystems (2)
SCSI IBM Power Linux RAID adapter
lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 ipr: Read buffer overflow

If `sglist->num_dma_sg' is zero we write ioadl[-1]

Signed-off-by Roel Kluin <[email protected]>

---
Is it possible for sglist->num_dma_sg to be 0?

drivers/scsi/ipr.c +3 -2
index 5f04550..736ad07 100644
@@ -3004,8 +3004,9 @@ static void ipr_build_ucode_ioadl(struct ipr_cmnd *ipr_cmd,
 			cpu_to_be32(sg_dma_address(&scatterlist[i]));
 	}
 
-	ioadl[i-1].flags_and_data_len |=
-		cpu_to_be32(IPR_IOADL_FLAGS_LAST);
+	if (i != 0)
+		ioadl[i-1].flags_and_data_len |=
+			cpu_to_be32(IPR_IOADL_FLAGS_LAST);
 }
 
 /**
#1 lore raw
Quoted 5 lines · Roel Kluin

If `sglist->num_dma_sg' is zero we write ioadl[-1]

Signed-off-by Roel Kluin <[email protected]>

---
Is it possible for sglist->num_dma_sg to be 0?

No. Its not possible. The code in ipr_update_ioa_ucode ensures this.

Thanks,

Brian

Quoted 21 lines
drivers/scsi/ipr.c +3 -3
index 5f04550..736ad07 100644
@@ -3004,8 +3004,9 @@ static void ipr_build_ucode_ioadl(struct ipr_cmnd *ipr_cmd,
 			cpu_to_be32(sg_dma_address(&scatterlist[i]));
 	}
 
-	ioadl[i-1].flags_and_data_len |=
-		cpu_to_be32(IPR_IOADL_FLAGS_LAST);
+	if (i != 0)
+		ioadl[i-1].flags_and_data_len |=
+			cpu_to_be32(IPR_IOADL_FLAGS_LAST);
 }
 
 /**
--

To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Signature · 3 lines
Brian King
Linux on Power Virtualization
IBM Linux Technology Center