Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9ab98f57 authored by FUJITA Tomonori's avatar FUJITA Tomonori Committed by James Bottomley
Browse files

[SCSI] scsi_debug: fix map_region and unmap_region oops 



map_region and unmap_region could access to invalid memory area since
they don't check the size boundary.

Signed-off-by: default avatarFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 4289a086

drivers/scsi/scsi_debug.c

+4 −2
Original line number Diff line number Diff line
@@ -1991,6 +1991,7 @@ static void map_region(sector_t lba, unsigned int len) 
		block = lba + alignment;

		rem = do_div(block, granularity);



		if (block < map_size)

			set_bit(block, map_storep);



		lba += granularity - rem;
@@ -2011,7 +2012,8 @@ static void unmap_region(sector_t lba, unsigned int len) 
		block = lba + alignment;

		rem = do_div(block, granularity);



		if (rem == 0 && lba + granularity <= end)

		if (rem == 0 && lba + granularity <= end &&

		    block < map_size)

			clear_bit(block, map_storep);



		lba += granularity - rem;