lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 13 Aug 2007 06:56:35 -0400 From: James Smart <James.Smart@...lex.Com> To: Jesper Juhl <jesper.juhl@...il.com> CC: Andrew Morton <akpm@...ux-foundation.org>, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, linux-scsi@...r.kernel.org, James Bottomley <James.Bottomley@...eleye.com> Subject: Re: [PATCH 4/6][RESEND] Emulex FC HBA driver: fix overflow of statically allocated array NACK The fix is contained in our 8.2.2 sources recently posted and pushed by James as part of his last scsi fixes. -- james s Jesper Juhl wrote: > (previously send on 09-Aug-2007 20:47) > > Hi, > > The Coverity checker noticed that we may overrun a statically allocated > array in drivers/scsi/lpfc/lpfc_sli.c::lpfc_sli_hbqbuf_find(). > > The case is this; In 'struct lpfc_hba' we have > > #define LPFC_MAX_HBQS 4 > ... > struct lpfc_hba { > ... > struct hbq_s hbqs[LPFC_MAX_HBQS]; > ... > }; > > But then in lpfc_sli_hbqbuf_find() we have this code > > hbqno = tag >> 16; > if (hbqno > LPFC_MAX_HBQS) > return NULL; > > if 'hbqno' ends up as exactely 4, then we won't return, and then this > > list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) { > > will cause an overflow of the statically allocated array at index 4, > since the valid indices are only 0-3. > > I propose this patch, that simply changes the 'hbqno > LPFC_MAX_HBQS' > into 'hbqno >= LPFC_MAX_HBQS' as a possible fix. > > > Signed-off-by: Jesper Juhl <jesper.juhl@...il.com> > Acked-by: James Smart <james.smart@...lex.com> > --- > > drivers/scsi/lpfc/lpfc_sli.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c > index ce5ff2b..e5337ad 100644 > --- a/drivers/scsi/lpfc/lpfc_sli.c > +++ b/drivers/scsi/lpfc/lpfc_sli.c > @@ -675,7 +675,7 @@ lpfc_sli_hbqbuf_find(struct lpfc_hba *phba, uint32_t tag) > uint32_t hbqno; > > hbqno = tag >> 16; > - if (hbqno > LPFC_MAX_HBQS) > + if (hbqno >= LPFC_MAX_HBQS) > return NULL; > > list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) { > > > > - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists