diff options
| author | NeilBrown <neilb@suse.com> | 2015-09-05 11:07:04 +0200 |
|---|---|---|
| committer | NeilBrown <neilb@suse.com> | 2015-09-05 11:08:32 +0200 |
| commit | e89c6fdf9e0eb1b5a03574d4ca73e83eae8deb91 (patch) | |
| tree | f9df292ed03a5a3c4ddc658ae3646f02a1ffafce /drivers/message/fusion/mptctl.c | |
| parent | c3cce6cda162eb2b2960a85d9c8992f4f3be85d0 (diff) | |
| parent | 1081230b748de8f03f37f80c53dfa89feda9b8de (diff) | |
Merge linux-block/for-4.3/core into md/for-linux
There were a few conflicts that are fairly easy to resolve.
Signed-off-by: NeilBrown <neilb@suse.com>
Diffstat (limited to 'drivers/message/fusion/mptctl.c')
| -rw-r--r-- | drivers/message/fusion/mptctl.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c index 70bb7530b22c..fc7393729081 100644 --- a/drivers/message/fusion/mptctl.c +++ b/drivers/message/fusion/mptctl.c @@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr) } spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags); + /* Basic sanity checks to prevent underflows or integer overflows */ + if (karg.maxReplyBytes < 0 || + karg.dataInSize < 0 || + karg.dataOutSize < 0 || + karg.dataSgeOffset < 0 || + karg.maxSenseBytes < 0 || + karg.dataSgeOffset > ioc->req_sz / 4) + return -EINVAL; + /* Verify that the final request frame will not be too large. */ sz = karg.dataSgeOffset * 4; |