On 12/13/2013 06:31 PM, Yu Chen wrote: > Thank you! The new patch > ------------------------------------------------------------- > [PATCH] scsi: integer overflow in megadev_ioctl() > > There is a potential integer overflow in megadev_ioctl() if > userspace passes in a large u32 variable uioc.adapno. > Theint variable adapno would < 0, leading to a error Typo here, 'theint' should be 'the int' also it should be 'an error' instead of 'a error'
> array access for hdb_soft_state[adapno], or a error Here as well. > copy_to_user(uioc.uioc_uaddr, mcontroller+adapno,..) > > Reported-by: Wenliang Fan <fanwle...@gmail.com> > Suggested-by: Qixue Xiao <xiaoqixu...@163.com> > Signed-off-by: Yu Chen <chy...@gmail.com> Reviewed-by: Levente Kurusa <le...@linux.com> (Once you have fixed my suggestions :-) ) > --- > drivers/scsi/megaraid.c | 16 ++++++++++++---- > 1 file changed, 12 insertions(+), 4 deletions(-) > > diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c > index 41bbc21..0b90c54 100644 > --- a/drivers/scsi/megaraid.c > +++ b/drivers/scsi/megaraid.c > @@ -3099,7 +3099,10 @@ megadev_ioctl(struct file *filep, unsigned int > cmd, unsigned long arg) > /* > * Which adapter > */ > - if( (adapno = GETADAP(uioc.adapno)) >= hba_count ) > + adapno = GETADAP(uioc.adapno); > + if( adapno < 0 ) > + return (-EINVAL); > + if( adapno >= hba_count ) > return (-ENODEV); > > if( copy_to_user(uioc.uioc_uaddr, mcontroller+adapno, Total whitespace damage. :-) Try sending them with 'git send-email' or configure your email client properly. Oh, and one last thing. Don't post the v3 as a reply to this, but instead as a whole new post. -- Regards, Levente Kurusa -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
