projects / wrapfs-4.7.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2ea1e5b) | patch
scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 15 Sep 2016 13:44:56 +0000 (16:44 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 22 Oct 2016 10:06:48 +0000 (12:06 +0200)
commit6e3655655623c52a8a55cec01be8cf6681ee54a3
tree9ea5b94a94a8b01d465cf0d359c1b5deb37eeb9btree | snapshot
parent2ea1e5b248e29791ec72a5cf9eb6b28fe315ee76commit | diff
scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()

commit 7bc2b55a5c030685b399bb65b6baa9ccc3d1f167 upstream.

We need to put an upper bound on "user_len" so the memcpy() doesn't
overflow.

Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/arcmsr/arcmsr_hba.c diff | blob | history
wrapfs-4.7.y