Commit e6fd916a authored by Dan Carpenter's avatar Dan Carpenter Committed by Martin K. Petersen

scsi: aacraid: reading out of bounds

"qd.id" comes directly from the copy_from_user() on the line before so
we should verify that it's within bounds.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 722477c4
...@@ -3198,10 +3198,11 @@ static int query_disk(struct aac_dev *dev, void __user *arg) ...@@ -3198,10 +3198,11 @@ static int query_disk(struct aac_dev *dev, void __user *arg)
return -EBUSY; return -EBUSY;
if (copy_from_user(&qd, arg, sizeof (struct aac_query_disk))) if (copy_from_user(&qd, arg, sizeof (struct aac_query_disk)))
return -EFAULT; return -EFAULT;
if (qd.cnum == -1) if (qd.cnum == -1) {
if (qd.id < 0 || qd.id >= dev->maximum_num_containers)
return -EINVAL;
qd.cnum = qd.id; qd.cnum = qd.id;
else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) } else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) {
{
if (qd.cnum < 0 || qd.cnum >= dev->maximum_num_containers) if (qd.cnum < 0 || qd.cnum >= dev->maximum_num_containers)
return -EINVAL; return -EINVAL;
qd.instance = dev->scsi_host_ptr->host_no; qd.instance = dev->scsi_host_ptr->host_no;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment