Dan Carpenter
f63ae56e4e
[SCSI] gdth: integer overflow in ioctl ...
gdth_ioctl_alloc() takes the size variable as an int.
copy_from_user() takes the size variable as an unsigned long.
gen.data_len and gen.sense_len are unsigned longs.
On x86_64 longs are 64 bit and ints are 32 bit.
We could pass in a very large number and the allocation would truncate
the size to 32 bits and allocate a small buffer. Then when we do the
copy_from_user(), it would result in a memory corruption.
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2010-10-25 15:01:14 -05:00
2010-10-22 10:52:56 -07:00
2010-10-08 10:02:27 +01:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-22 20:30:48 -07:00
2010-10-23 11:47:02 -07:00
2010-10-05 15:01:10 +02:00
2010-10-24 13:41:39 -07:00
2010-09-28 23:30:38 -04:00
2010-10-24 12:44:34 -07:00
2010-10-22 10:52:56 -07:00
2010-10-24 13:41:39 -07:00
2010-10-23 11:47:02 -07:00
2010-10-24 13:41:39 -07:00
2010-10-18 22:34:25 +01:00
2010-10-24 13:41:39 -07:00
2010-10-23 22:59:33 +02:00
2010-10-24 13:41:39 -07:00
2010-10-24 18:16:59 +02:00
2010-10-24 13:41:39 -07:00
2010-10-22 10:52:56 -07:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-07 14:02:12 -04:00
2010-10-15 15:53:27 +02:00
2010-10-24 13:41:39 -07:00
2010-10-22 17:07:18 -07:00
2010-10-24 13:41:39 -07:00
2010-10-05 15:01:10 +02:00
2010-10-22 17:34:15 -07:00
2010-10-22 10:52:56 -07:00
2010-10-24 13:41:39 -07:00
2010-10-22 17:07:18 -07:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-22 10:52:56 -07:00
2010-10-18 11:03:14 +02:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-22 10:52:56 -07:00
2010-10-24 13:41:39 -07:00
2010-10-07 13:44:30 -07:00
2010-10-24 13:41:39 -07:00
2010-10-25 09:42:38 -05:00
2010-10-22 10:52:56 -07:00
2010-10-25 15:01:14 -05:00
2010-10-24 13:41:39 -07:00
2010-10-22 10:52:56 -07:00
2010-09-29 17:20:23 +02:00
2010-10-24 13:41:39 -07:00
2010-10-22 10:52:56 -07:00
2010-10-24 13:41:39 -07:00
2010-10-24 13:41:39 -07:00
2010-10-22 10:21:40 -07:00
2010-10-23 11:47:02 -07:00
2010-10-24 13:41:39 -07:00
2010-10-07 14:08:54 +01:00
2010-10-22 10:52:56 -07:00
2010-10-22 10:52:56 -07:00
2010-10-22 09:43:25 +02:00
f63ae56e4e