Eric Lee / linux-smarc-t335x-v3.2

Download as
Browse Code ยป

Commit 9ab98f57b3e1d73cd0720d29c21b687ba609cde9

Authored by FUJITA Tomonori
Committed by James Bottomley
1 parent 4289a08680
Exists in master and in 4 other branches v3.2_AM335xPSP_04.06.00.11, v3.2_NEWT335xPSP_04.06.00.11, v3.2_SBC_SMARTMEN, v3.2_SMARCT335xPSP_04.06.00.11

[SCSI] scsi_debug: fix map_region and unmap_region oops 

map_region and unmap_region could access to invalid memory area since
they don't check the size boundary.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

Showing 1 changed file with 4 additions and 2 deletions Side-by-side Diff

drivers/scsi/scsi_debug.c
Diff comments   View file @ 9ab98f5
... ... @@ -1991,7 +1991,8 @@
1991 1991 block = lba + alignment;
1992 1992 rem = do_div(block, granularity);
1993 1993  
1994   - set_bit(block, map_storep);
  1994 + if (block < map_size)
  1995 + set_bit(block, map_storep);
1995 1996  
1996 1997 lba += granularity - rem;
1997 1998 }
... ... @@ -2011,7 +2012,8 @@
2011 2012 block = lba + alignment;
2012 2013 rem = do_div(block, granularity);
2013 2014  
2014   - if (rem == 0 && lba + granularity <= end)
  2015 + if (rem == 0 && lba + granularity <= end &&
  2016 + block < map_size)
2015 2017 clear_bit(block, map_storep);
2016 2018  
2017 2019 lba += granularity - rem;