rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

scsi: sg: check length passed to SG_NEXT_CMD_LEN

Browse Source 
The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Change-Id: I9e8eb8ca058c0103a22f5d99d77919432893aa4c
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
CVE-2017-7187
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
peter chang
2019-08-06 12:26:35 +02:00
committed by Francescodario Cuzzocrea
parent 1c887f963c
commit 2f91ba612a
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/scsi/sg.c
+2
View File
@@ -963,6 +963,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
result = get_user(val, ip);
if (result)
return result;
if (val > SG_MAX_CDB_SIZE)
return -ENOMEM;
sfp->next_cmd_len = (val > 0) ? val : 0;
return 0;
case SG_GET_VERSION_NUM: