linux-kernel - Re: [RESEND PATCH v2] megaraid: fix out-of-bound array accesses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <yq1y38mgn3h.fsf@oracle.com>
Date:   Tue, 18 Dec 2018 23:24:50 -0500
From:   "Martin K. Petersen" <martin.petersen@...cle.com>
To:     Qian Cai <cai@....pw>
Cc:     akpm@...ux-foundation.org, kashyap.desai@...adcom.com,
        sumit.saxena@...adcom.com, shivasharan.srikanteshwara@...adcom.com,
        jejb@...ux.vnet.ibm.com, martin.petersen@...cle.com,
        thenzl@...hat.com, hch@....de, megaraidlinux.pdl@...adcom.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RESEND PATCH v2] megaraid: fix out-of-bound array accesses


> diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c
> index 59ecbb3b53b5..a33628550425 100644
> --- a/drivers/scsi/megaraid/megaraid_sas_fp.c
> +++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
> @@ -1266,7 +1266,7 @@ void mr_update_load_balance_params(struct MR_DRV_RAID_MAP_ALL *drv_map,
>  
>  	for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
>  		ld = MR_TargetIdToLdGet(ldCount, drv_map);
> -		if (ld >= MAX_LOGICAL_DRIVES_EXT) {
> +		if (ld >= MAX_LOGICAL_DRIVES_EXT - 1) {
>  			lbInfo[ldCount].loadBalanceFlag = 0;
>  			continue;
>  		}
> diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
> index f74b5ea24f0f..49eaa87608f6 100644
> --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
> +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
> @@ -2832,7 +2832,7 @@ static void megasas_build_ld_nonrw_fusion(struct megasas_instance *instance,
>  		device_id < instance->fw_supported_vd_count)) {
>  
>  		ld = MR_TargetIdToLdGet(device_id, local_map_ptr);
> -		if (ld >= instance->fw_supported_vd_count)
> +		if (ld >= instance->fw_supported_vd_count - 1)
>  			fp_possible = 0;
>  		else {
>  			raid = MR_LdRaidGet(ld, local_map_ptr);

Kashyap, Sumit, Shivasharan: Please review!

-- 
Martin K. Petersen	Oracle Linux Engineering