Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6fd916a authored by Dan Carpenter's avatar Dan Carpenter Committed by Martin K. Petersen
Browse files

scsi: aacraid: reading out of bounds 



"qd.id" comes directly from the copy_from_user() on the line before so
we should verify that it's within bounds.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 722477c4

drivers/scsi/aacraid/aachba.c

+4 −3
Original line number Diff line number Diff line
@@ -3198,10 +3198,11 @@ static int query_disk(struct aac_dev *dev, void __user *arg) 
		return -EBUSY;

	if (copy_from_user(&qd, arg, sizeof (struct aac_query_disk)))

		return -EFAULT;

	if (qd.cnum == -1)

	if (qd.cnum == -1) {

		if (qd.id < 0 || qd.id >= dev->maximum_num_containers)

			return -EINVAL;

		qd.cnum = qd.id;

	else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1))

	{

	} else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) {

		if (qd.cnum < 0 || qd.cnum >= dev->maximum_num_containers)

			return -EINVAL;

		qd.instance = dev->scsi_host_ptr->host_no;