Mahesh Rajashekhara b4789b8e6b
aacraid: prevent invalid pointer dereference ...
It appears that driver runs into a problem here if fibsize is too small
because we allocate user_srbcmd with fibsize size only but later we
access it until user_srbcmd->sg.count to copy it over to srbcmd.
It is not correct to test (fibsize < sizeof(*user_srbcmd)) because this
structure already includes one sg element and this is not needed for
commands without data. So, we would recommend to add the following
(instead of test for fibsize == 0).
Signed-off-by: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com >
Reported-by: Nico Golde <nico@ngolde.de >
Reported-by: Fabian Yamaguchi <fabs@goesec.de >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2013-11-19 16:27:39 -08:00
2013-11-19 16:27:39 -08:00
2013-09-10 14:48:16 -07:00
2013-10-14 15:26:04 +02:00
2013-10-25 09:58:11 +01:00
2013-11-15 16:47:22 -08:00
2013-11-10 12:19:15 +08:00
2013-11-15 16:47:22 -08:00
2013-11-15 16:47:22 -08:00
2013-08-20 13:06:40 +02:00
2013-10-25 11:19:33 +01:00
2013-10-25 09:58:59 +01:00
2013-11-14 12:25:38 +09:00
2013-11-15 16:47:22 -08:00
2013-09-06 11:41:34 -07:00
2013-08-26 12:51:30 +04:00
2013-09-04 13:52:35 -07:00
2013-11-15 16:47:22 -08:00
2013-11-15 16:47:22 -08:00
2013-09-03 07:27:58 -07:00
2013-09-06 11:42:53 -07:00
2013-10-14 15:26:04 +02:00
2013-07-25 16:34:39 -07:00
2013-11-15 16:47:22 -08:00
2013-11-15 16:47:22 -08:00
2013-11-15 16:47:22 -08:00
2013-10-14 15:31:06 +02:00
2013-11-15 16:47:22 -08:00
2013-06-24 16:32:22 -07:00
2013-06-24 19:44:18 +02:00
2013-06-24 19:44:18 +02:00
2013-10-25 11:44:54 +01:00
2013-10-14 15:26:04 +02:00
2013-10-25 09:57:57 +01:00
2013-06-26 18:32:47 -07:00
2013-07-09 22:52:29 +01:00
2013-11-15 16:47:22 -08:00
2013-10-25 11:40:42 +01:00
2013-10-25 11:36:26 +01:00
2013-09-03 07:27:58 -07:00
2013-08-01 18:08:34 -07:00
2013-08-01 18:08:34 -07:00
2013-06-26 18:32:47 -07:00
2013-10-14 15:26:04 +02:00
2013-10-25 12:17:59 +01:00
2013-11-15 16:47:22 -08:00
2013-08-26 12:51:31 +04:00
2013-08-26 12:51:32 +04:00
2013-08-26 12:51:32 +04:00
2013-10-25 09:58:13 +01:00
2013-09-03 15:48:06 -07:00
2013-07-09 18:24:39 -07:00
2013-08-26 18:53:49 +04:00
2013-09-03 07:27:58 -07:00
2013-10-14 15:26:04 +02:00
2013-10-14 15:31:06 +02:00
2013-06-19 17:53:35 +02:00
2013-11-19 15:50:47 -08:00
2013-10-25 09:58:12 +01:00
2013-06-24 13:00:10 -07:00
2013-10-25 12:18:30 +01:00
2013-10-31 14:49:26 +00:00
2013-10-25 09:58:13 +01:00
2013-06-24 13:00:10 -07:00
2013-10-25 12:17:59 +01:00
2013-07-03 16:07:41 -07:00
2013-10-25 09:58:01 +01:00
2013-11-08 14:43:16 -08:00
2013-10-25 12:00:23 +01:00
2013-11-14 12:25:38 +09:00
2013-10-25 09:58:16 +01:00
2013-10-25 10:59:54 +01:00
2013-08-21 10:10:50 -07:00
2013-10-14 15:26:04 +02:00
2013-08-02 11:34:30 +08:00
2013-11-15 16:47:22 -08:00
2013-10-25 11:51:37 +01:00
2013-11-11 11:53:26 +10:30
2013-10-14 15:26:04 +02:00
b4789b8e6b