Home » Mailing list archives » linux-kernel » 2007 » November » 15

[patch 32/40] hptiop: avoid buffer overflow when returning sense data

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Greg Kroah-Hartman <gregkh@...>
To: <linux-kernel@...>, <stable@...>, <James.Bottomley@...>
Cc: Justin Forbes <jmforbes@...>, Zwane Mwaikambo <zwane@...>, Theodore Ts'o <tytso@...>, Randy Dunlap <rdunlap@...>, Dave Jones <davej@...>, Chuck Wolber <chuckw@...>, Chris Wedgwood <reviews@...>, Michael Krufky <mkrufky@...>, Chuck Ebbert <cebbert@...>, Domenico Andreoli <cavokz@...>, <torvalds@...>, <akpm@...>, <alan@...>, <linux@...>, <linux-scsi@...>
Subject: [patch 32/40] hptiop: avoid buffer overflow when returning sense data
Date: Thursday, November 15, 2007 - 2:45 am

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: HighPoint Linux Team <linux@highpoint-tech.com>

patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline.

avoid buffer overflow when returning sense data.

With current adapter firmware the driver is working but future firmware
updates may return sense data larger than 96 bytes, causing overflow on
scp->sense_buffer and a kernel crash.

This fix should be backported to earlier kernels.

Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: James Bottomley <James.Bottomley@steeleye.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/scsi/hptiop.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -365,8 +365,9 @@ static void hptiop_host_request_callback
 		scp->result = SAM_STAT_CHECK_CONDITION;
 		memset(&scp->sense_buffer,
 				0, sizeof(scp->sense_buffer));
-		memcpy(&scp->sense_buffer,
-			&req->sg_list, le32_to_cpu(req->dataxfer_length));
+		memcpy(&scp->sense_buffer, &req->sg_list,
+				min(sizeof(scp->sense_buffer),
+					le32_to_cpu(req->dataxfer_length)));
 		break;
 
 	default:

-- 
-
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[patch 00/40] 2.6.23-stable review, driver (sans network) ch..., Greg Kroah-Hartman, (Thu Nov 15, 2:43 am)
[patch 40/40] ACPI: suspend: Wrong order of GPE restore., Greg Kroah-Hartman, (Thu Nov 15, 2:46 am)
[patch 39/40] ACPI: sleep: Fix GPE suspend cleanup, Greg Kroah-Hartman, (Thu Nov 15, 2:46 am)
[patch 38/40] libata: backport ATA_FLAG_NO_SRST and ATA_FLAG..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 37/40] libata: backport ATA_FLAG_NO_SRST and ATA_FLAG..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 35/40] radeon: set the address to access the GART tab..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 36/40] libata: add HTS542525K9SA00 to NCQ blacklist, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 33/40] Char: rocket, fix dynamic_dev tty, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 34/40] Char: moxa, fix and optimise empty timer, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 31/40] ide: Fix cs5535 driver accessing beyond array ..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 30/40] ide: Fix siimage driver accessing beyond array..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 32/40] hptiop: avoid buffer overflow when returning s..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 29/40] ide: Add ide_get_paired_drive() helper, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 27/40] i4l: fix random freezes with AVM B1 drivers, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 28/40] ide: fix serverworks.c UDMA regression, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 25/40] ALSA: hda-codec - Add array terminator for dmi..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 26/40] i4l: Fix random hard freeze with AVM c4 card, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 24/40] USB: usbserial - fix potential deadlock betwee..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 20/40] USB: remove USB_QUIRK_NO_AUTOSUSPEND, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
Re: [patch 20/40] USB: remove USB_QUIRK_NO_AUTOSUSPEND, Chuck Ebbert, (Thu Nov 15, 11:50 am)
Re: [patch 20/40] USB: remove USB_QUIRK_NO_AUTOSUSPEND, Alan Stern, (Thu Nov 15, 1:57 pm)
[patch 22/40] USB: mutual exclusion for EHCI init and port r..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 23/40] USB: add URB_FREE_BUFFER to permissible flags, Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 21/40] usb-gadget-ether: prevent oops caused by error..., Greg Kroah-Hartman, (Thu Nov 15, 2:45 am)
[patch 19/40] MSI: Use correct data offset for 32-bit MSI in..., Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 18/40] md: raid5: fix clearing of biofill operations, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 17/40] md: fix an unsigned compare to allow creation ..., Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 16/40] dm: fix thaw_bdev, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 15/40] dm delay: fix status, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 14/40] libata: sync NCQ blacklist with upstream, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 13/40] ALSA: hdsp - Fix zero division, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 12/40] ALSA: emu10k1 - Fix memory corruption, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 11/40] ALSA: Fix build error without CONFIG_HAS_DMA, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 10/40] ALSA: fix selector unit bug affecting some USB..., Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 09/40] ALSA: hda-codec - Avoid zero NID in line_out_p..., Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 08/40] IB/mthca: Use mmiowb() to avoid firmware comma..., Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 07/40] IB/uverbs: Fix checking of userspace object ow..., Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 06/40] hwmon/lm87: Disable VID when it should be, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 05/40] hwmon/lm87: Fix a division by zero, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 03/40] hwmon/w83627hf: Fix setting fan min right afte..., Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 04/40] hwmon/w83627hf: Dont assume bank 0, Greg Kroah-Hartman, (Thu Nov 15, 2:44 am)
[patch 02/40] i915: fix vbl swap allocation size., Greg Kroah-Hartman, (Thu Nov 15, 2:43 am)
[patch 01/40] POWERPC: Fix platinumfb framebuffer, Greg Kroah-Hartman, (Thu Nov 15, 2:43 am)