Mahesh Rajashekhara
b4789b8e6b
aacraid: prevent invalid pointer dereference ...
It appears that driver runs into a problem here if fibsize is too small
because we allocate user_srbcmd with fibsize size only but later we
access it until user_srbcmd->sg.count to copy it over to srbcmd.
It is not correct to test (fibsize < sizeof(*user_srbcmd)) because this
structure already includes one sg element and this is not needed for
commands without data. So, we would recommend to add the following
(instead of test for fibsize == 0).
Signed-off-by: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-11-19 16:27:39 -08:00
2013-11-19 15:50:47 -08:00
2013-10-31 14:48:38 +00:00
2013-11-15 09:32:21 +09:00
2013-11-19 15:53:02 -05:00
2013-10-29 12:53:07 +02:00
2013-11-15 16:47:22 -08:00
2013-11-13 17:40:34 +09:00
2013-11-15 16:33:41 -08:00
2013-11-05 15:58:21 -05:00
2013-11-14 08:51:29 +09:00
2013-11-16 10:19:15 -08:00
2013-11-15 16:47:22 -08:00
2013-11-14 17:19:20 -05:00
2013-11-15 16:47:22 -08:00
2013-11-14 13:41:48 +09:00
2013-11-15 09:32:21 +09:00
2013-11-07 19:24:20 +01:00
2013-11-15 16:47:22 -08:00
2013-11-18 14:51:52 -08:00
2013-11-15 09:32:21 +09:00
2013-11-14 07:55:21 +09:00
2013-11-14 08:51:29 +09:00
2013-11-18 15:50:07 -08:00
2013-11-15 16:48:22 -08:00
2013-11-15 16:35:10 -08:00
2013-11-18 15:50:07 -08:00
2013-11-14 18:21:25 -05:00
2013-11-14 13:41:48 +09:00
2013-11-15 09:32:23 +09:00
2013-11-18 15:36:04 -08:00
2013-11-15 16:48:22 -08:00
2013-11-15 18:57:42 -08:00
2013-11-14 08:51:29 +09:00
2013-11-14 16:50:20 -05:00
2013-11-07 12:13:05 +10:30
2013-11-12 16:52:17 +09:00
2013-11-15 16:47:22 -08:00
2013-11-18 15:50:07 -08:00
2013-11-15 09:32:21 +09:00
2013-11-13 12:09:26 +09:00
2013-11-15 16:47:22 -08:00
2013-11-18 15:50:07 -08:00
2013-11-18 14:47:30 -08:00
2013-11-15 16:47:22 -08:00
2013-11-19 15:50:47 -08:00
2013-11-14 07:55:21 +09:00
2013-11-15 14:05:15 -08:00
2013-11-15 09:32:23 +09:00
2013-11-12 16:52:17 +09:00
2013-11-14 10:43:17 -08:00
2013-11-15 09:32:21 +09:00
2013-11-14 13:41:48 +09:00
2013-11-18 15:35:09 -08:00
2013-11-05 02:36:57 +01:00
2013-11-13 12:09:35 +09:00
2013-11-01 11:17:57 +01:00
2013-11-15 16:47:22 -08:00
2013-10-29 11:28:11 +10:30
2013-11-15 09:32:21 +09:00
2013-11-19 11:43:21 -08:00
2013-11-19 16:27:39 -08:00
2013-11-15 09:32:21 +09:00
2013-11-18 15:10:05 -08:00
2013-11-19 15:50:47 -08:00
2013-11-15 13:34:37 +09:00
2013-11-13 12:09:23 +09:00
2013-11-15 16:47:22 -08:00
2013-11-07 11:42:15 +09:00
2013-11-16 12:45:55 -08:00
2013-11-15 13:28:47 +09:00
2013-11-15 09:32:21 +09:00
2013-11-18 21:34:19 +01:00
2013-11-15 13:34:37 +09:00
2013-11-14 13:41:48 +09:00
2013-11-14 13:41:48 +09:00
b4789b8e6b