mptfusion: Add bounds check in mptctl_hp_targetinfo()

PATCH Applied Dan Carpenter 3 participants 3 messages Jan 25, 2018 – Jan 31, 2018

Subsystems (3)

SCSI Kernel janitors LSI Logic MPT fusion drivers (FC/SAS/SPI)

lore

Share & tools

lore

Dan Carpenter

author

2018-01-25 14:27 UTC #0 lore raw

PATCH 1/1 mptfusion: Add bounds check in mptctl_hp_targetinfo()

My static checker complains about an out of bounds read:

    drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
    error: buffer overflow 'hd->sel_timeout' 255 <= u32max.

It's true that we probably should have a bounds check here.

Signed-off-by Dan Carpenter <[email protected]>

drivers/message/fusion/mptctl.c +2 -0

index 8d12017b9893..4470630dd545 100644
@@ -2687,6 +2687,8 @@ mptctl_hp_targetinfo(unsigned long arg)
 				__FILE__, __LINE__, iocnum);
 		return -ENODEV;
 	}
+	if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+		return -EINVAL;
 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
 	    ioc->name));

Johannes Thumshirn

Reviewed-by on v1 1/1

2018-01-29 14:57 UTC #1 lore raw

Looks good,

Reviewed-by Johannes Thumshirn <[email protected]>

Signature · 6 lines

Johannes Thumshirn                                          Storage
[email protected]                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

Martin K. Petersen

Applied

2018-01-31 02:32 UTC #2 lore raw

In reply to Dan Carpenter

Dan,

Quoted 6 lines

My static checker complains about an out of bounds read:
    drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
    error: buffer overflow 'hd->sel_timeout' 255 <= u32max.
It's true that we probably should have a bounds check here.

Applied to 4.16/scsi-fixes, thanks!

Signature · 1 line

Martin K. Petersen	Oracle Linux Engineering