From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752985Ab3LMQzz (ORCPT ); Fri, 13 Dec 2013 11:55:55 -0500 Received: from mail-vc0-f174.google.com ([209.85.220.174]:53221 "EHLO mail-vc0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751602Ab3LMQzx (ORCPT ); Fri, 13 Dec 2013 11:55:53 -0500 MIME-Version: 1.0 Date: Sat, 14 Dec 2013 00:55:53 +0800 Message-ID: Subject: [PATCH] scsi: integer overflow in megadev_ioctl() From: Yu Chen To: linux-kernel@vger.kernel.org Cc: megaraidlinux@lsi.com, xiaoqixue_1 , =?GB2312?B?t7bOxMG8?= Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There is a potential integer overflow in megadev_ioctl() if userspace passes in a large u32 variable uioc.adapno. The int variable adapno would < 0, leading to a error array access for hdb_soft_state[adapno]. Reported-by: Wenliang Fan Suggested-by: Qixue Xiao Signed-off-by: Yu Chen --- drivers/scsi/megaraid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c index 816db12..41bbc21 100644 --- a/drivers/scsi/megaraid.c +++ b/drivers/scsi/megaraid.c @@ -3113,7 +3113,8 @@ megadev_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) /* * Which adapter */ - if( (adapno = GETADAP(uioc.adapno)) >= hba_count ) + adapno = GETADAP(uioc.adapno); + if( adapno >= hba_count || adapno < 0 ) return (-ENODEV); adapter = hba_soft_state[adapno]; -- 1.8.3.2