Arnd Bergmann fd819f5406 scsi: megaraid_sas: Check user-provided offsets ... commit 381d34e376 upstream. It sounds unwise to let user space pass an unchecked 32-bit offset into a kernel structure in an ioctl. This is an unsigned variable, so checking the upper bound for the size of the structure it points into is sufficient to avoid data corruption, but as the pointer might also be unaligned, it has to be written carefully as well. While I stumbled over this problem by reading the code, I did not continue checking the function for further problems like it. Link: https://lore.kernel.org/r/20201030164450.1253641-2-arnd@kernel.org Fixes: c4a3e0a529 ("[SCSI] MegaRAID SAS RAID: new driver") Cc: <stable@vger.kernel.org> # v2.6.15+ Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-12-30 11:50:59 +01:00
..
Kconfig.megaraid	SCSI misc on 20190709	2019-07-11 15:14:01 -07:00
Makefile	scsi: megaraid_sas: Export RAID map through debugfs	2019-06-18 19:46:20 -04:00
mbox_defs.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
mega_common.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
megaraid_ioctl.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
megaraid_mbox.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
megaraid_mbox.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
megaraid_mm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
megaraid_mm.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
megaraid_sas.h	scsi: megaraid_sas: Introduce module parameter for default queue depth	2019-08-12 21:40:37 -04:00
megaraid_sas_base.c	scsi: megaraid_sas: Check user-provided offsets	2020-12-30 11:50:59 +01:00
megaraid_sas_debugfs.c	scsi: megaraid_sas: Remove unused including <linux/version.h>	2019-06-18 19:46:25 -04:00
megaraid_sas_fp.c	SCSI misc on 20190709	2019-07-11 15:14:01 -07:00
megaraid_sas_fusion.c	scsi: megaraid_sas: Don't call disable_irq from process IRQ poll	2020-09-17 13:47:43 +02:00
megaraid_sas_fusion.h	scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state	2020-02-11 04:35:23 -08:00