linux/drivers/message/fusion
Dan Carpenter e819cdb198 mptfusion: prevent some memory corruption
These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz".  We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
2015-08-26 07:11:45 -07:00
..
lsi SCSI updates for post 3.2 merge window 2012-01-10 10:36:08 -08:00
Kconfig scsi: use 'depends' instead of 'select' for SCSI_FC_ATTRS 2014-09-16 16:55:55 -04:00
Makefile message: change to new flag variable 2011-03-17 14:05:34 +01:00
mptbase.c fusion: remove dead MTRR code 2015-06-13 08:44:14 -07:00
mptbase.h fusion: remove dead MTRR code 2015-06-13 08:44:14 -07:00
mptctl.c mptfusion: prevent some memory corruption 2015-08-26 07:11:45 -07:00
mptctl.h
mptdebug.h [SCSI] mpt fusion: Fixing 1078 data corruption issue for 36GB memory region 2009-06-09 17:21:31 -05:00
mptfc.c mptfusion: remove redundant kfree checks 2014-07-25 17:16:57 -04:00
mptlan.c [SCSI] mptfusion: Extra debug prints added relavent to Device missing delay error handling 2010-07-28 09:07:47 -05:00
mptlan.h tokenring: delete all remaining driver support 2012-05-15 20:23:16 -04:00
mptsas.c mptsas: fix depth param in scsi_track_queue_full 2015-06-13 08:40:33 -07:00
mptsas.h mptfusion: combine fw_event_work and its event_data 2014-07-25 17:16:58 -04:00
mptscsih.c scsi: drop reason argument from ->change_queue_depth 2014-11-24 14:45:27 +01:00
mptscsih.h scsi: drop reason argument from ->change_queue_depth 2014-11-24 14:45:27 +01:00
mptspi.c mptfusion: enable no_write_same for vmware scsi disks 2014-09-25 14:24:48 +02:00