diff options
| author | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2015-12-15 14:52:16 -0300 |
|---|---|---|
| committer | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2015-12-15 14:52:16 -0300 |
| commit | 8d91c1e411f55d7ea91b1183a2e9f8088fb4d5be (patch) | |
| tree | e9891aa6c295060d065adffd610c4f49ecf884f3 /drivers/message/fusion | |
| parent | a71852147516bc1cb5b0b3cbd13639bfd4022dc8 (diff) | |
Linux-libre 4.3.2-gnu
Diffstat (limited to 'drivers/message/fusion')
| -rw-r--r-- | drivers/message/fusion/mptctl.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c index 70bb7530b..fc7393729 100644 --- a/drivers/message/fusion/mptctl.c +++ b/drivers/message/fusion/mptctl.c @@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr) } spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags); + /* Basic sanity checks to prevent underflows or integer overflows */ + if (karg.maxReplyBytes < 0 || + karg.dataInSize < 0 || + karg.dataOutSize < 0 || + karg.dataSgeOffset < 0 || + karg.maxSenseBytes < 0 || + karg.dataSgeOffset > ioc->req_sz / 4) + return -EINVAL; + /* Verify that the final request frame will not be too large. */ sz = karg.dataSgeOffset * 4; |