Re: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

2016-09-26 Thread Martin K. Petersen
> "Borislav" == Borislav Petkov writes: Borislav> Yap, Tomas said the kfree was missing on the error path but Borislav> can we simplify this further by doing the user_len check first Borislav> so that the kfree() is not even needed? Applied to 4.9/scsi-queue. -- Martin K. Petersen Ora

Re: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

2016-09-26 Thread Tomas Henzl
On 23.9.2016 13:22, Borislav Petkov wrote: > On Thu, Sep 15, 2016 at 09:59:01AM -0400, Martin K. Petersen wrote: >>> "Dan" == Dan Carpenter writes: >> Dan> We need to put an upper bound on "user_len" so the memcpy() doesn't >> Dan> overflow. >> >> Applied to 4.9/scsi-queue. > Yap, Tomas said t

Re: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

2016-09-26 Thread Johannes Thumshirn
On Fri, Sep 23, 2016 at 01:22:26PM +0200, Borislav Petkov wrote: > On Thu, Sep 15, 2016 at 09:59:01AM -0400, Martin K. Petersen wrote: > > > "Dan" == Dan Carpenter writes: > > > > Dan> We need to put an upper bound on "user_len" so the memcpy() doesn't > > Dan> overflow. > > > > Applied to 4

Re: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

2016-09-23 Thread Borislav Petkov
On Thu, Sep 15, 2016 at 09:59:01AM -0400, Martin K. Petersen wrote: > > "Dan" == Dan Carpenter writes: > > Dan> We need to put an upper bound on "user_len" so the memcpy() doesn't > Dan> overflow. > > Applied to 4.9/scsi-queue. Yap, Tomas said the kfree was missing on the error path but can

Re: [patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

2016-09-15 Thread Martin K. Petersen
> "Dan" == Dan Carpenter writes: Dan> We need to put an upper bound on "user_len" so the memcpy() doesn't Dan> overflow. Applied to 4.9/scsi-queue. -- Martin K. Petersen Oracle Linux Engineering -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a

[patch v2] arcmsr: buffer overflow in arcmsr_iop_message_xfer()

2016-09-15 Thread Dan Carpenter
We need to put an upper bound on "user_len" so the memcpy() doesn't overflow. Reported-by: Marco Grassi Signed-off-by: Dan Carpenter Reviewed-by: Tomas Henzl diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c index 7640498..110eca9 100644 --- a/drivers/scsi/arcmsr