lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
e59fb3120b
android_kernel_xiaomi_sm8350/drivers/scsi
History
Dan Rosenberg 5f6279da37 [SCSI] pmcraid: reject negative request size 
There's a code path in pmcraid that can be reached via device ioctl that
causes all sorts of ugliness, including heap corruption or triggering
the OOM killer due to consecutive allocation of large numbers of pages.
Not especially relevant from a security perspective, since users must
have CAP_SYS_ADMIN to open the character device.

First, the user can call pmcraid_chr_ioctl() with a type
PMCRAID_PASSTHROUGH_IOCTL.  A pmcraid_passthrough_ioctl_buffer
is copied in, and the request_size variable is set to
buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed
value provided by the user.

If a negative value is provided here, bad things can happen.  For
example, pmcraid_build_passthrough_ioadls() is called with this
request_size, which immediately calls pmcraid_alloc_sglist() with a
negative size.  The resulting math on allocating a scatter list can
result in an overflow in the kzalloc() call (if num_elem is 0, the
sglist will be smaller than expected), or if num_elem is unexpectedly
large the subsequent loop will call alloc_pages() repeatedly, a high
number of pages will be allocated and the OOM killer might be invoked.

Prevent this value from being negative in pmcraid_ioctl_passthrough().

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Cc: Anil Ravindranath <anil_ravindranath@pmc-sierra.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2011-04-24 12:15:07 -05:00
..
aacraid Fix common misspellings 2011-03-31 11:26:23 -03:00
aic7xxx Fix common misspellings 2011-03-31 11:26:23 -03:00
aic7xxx_old Fix common misspellings 2011-03-31 11:26:23 -03:00
aic94xx Fix common misspellings 2011-03-31 11:26:23 -03:00
arcmsr Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
arm Fix common misspellings 2011-03-31 11:26:23 -03:00
be2iscsi Fix common misspellings 2011-03-31 11:26:23 -03:00
bfa Fix common misspellings 2011-03-31 11:26:23 -03:00
bnx2fc Fix common misspellings 2011-03-31 11:26:23 -03:00
bnx2i Fix common misspellings 2011-03-31 11:26:23 -03:00
cxgbi Fix common misspellings 2011-03-31 11:26:23 -03:00
device_handler [SCSI] scsi_dh: fix reference counting in scsi_dh_activate error path 2011-04-24 11:02:09 -05:00
dpt Fix common misspellings 2011-03-31 11:26:23 -03:00
fcoe Fix common misspellings 2011-03-31 11:26:23 -03:00
fnic Fix common misspellings 2011-03-31 11:26:23 -03:00
ibmvscsi [SCSI] ibmvfc: Improve ibmvfc_async_desc memory layout 2010-12-21 12:24:49 -06:00
libfc Fix common misspellings 2011-03-31 11:26:23 -03:00
libsas Fix common misspellings 2011-03-31 11:26:23 -03:00
lpfc Fix common misspellings 2011-03-31 11:26:23 -03:00
megaraid Fix common misspellings 2011-03-31 11:26:23 -03:00
mpt2sas [SCSI] mpt2sas: prevent heap overflows and unchecked reads 2011-04-24 11:01:59 -05:00
mvsas [SCSI] mvsas: Add support for HighPoint RR27xx series HBA 2011-03-23 11:35:59 -05:00
osd [SCSI] libosd: osd_req_read_sg, optimize the single entry case 2011-01-24 12:06:31 -06:00
pcmcia Fix common misspellings 2011-03-31 11:26:23 -03:00
pm8001 Fix common misspellings 2011-03-31 11:26:23 -03:00
qla2xxx Fix common misspellings 2011-03-31 11:26:23 -03:00
qla4xxx Fix common misspellings 2011-03-31 11:26:23 -03:00
sym53c8xx_2 Fix common misspellings 2011-03-31 11:26:23 -03:00
.gitignore
3w-9xxx.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
3w-9xxx.h Fix common misspellings 2011-03-31 11:26:23 -03:00
3w-sas.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
3w-sas.h
3w-xxxx.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
3w-xxxx.h Fix common misspellings 2011-03-31 11:26:23 -03:00
53c700_d.h_shipped Fix common misspellings 2011-03-31 11:26:23 -03:00
53c700.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
53c700.h
53c700.scr Fix common misspellings 2011-03-31 11:26:23 -03:00
a100u2w.c Merge branch 'master' into for-next 2010-12-22 18:57:02 +01:00
a100u2w.h
a2091.c
a2091.h
a3000.c
a3000.h
a4000t.c
advansys.c Fix common misspellings 2011-03-31 11:26:23 -03:00
aha152x.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
aha152x.h
aha1542.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
aha1542.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
aha1740.c Fix common misspellings 2011-03-31 11:26:23 -03:00
aha1740.h
aic7xxx_old.c Fix common misspellings 2011-03-31 11:26:23 -03:00
atari_NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
atari_scsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
atari_scsi.h
atp870u.c Fix common misspellings 2011-03-31 11:26:23 -03:00
atp870u.h
BusLogic.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
BusLogic.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
bvme6000_scsi.c
ch.c Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl 2010-10-22 10:52:56 -07:00
constants.c
dc395x.c Fix common misspellings 2011-03-31 11:26:23 -03:00
dc395x.h Fix common misspellings 2011-03-31 11:26:23 -03:00
dmx3191d.c
dpt_i2o.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
dpti.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
dtc.c
dtc.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
eata_generic.h
eata_pio.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
eata_pio.h
eata.c Fix common misspellings 2011-03-31 11:26:23 -03:00
esp_scsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
esp_scsi.h
fd_mcs.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
fdomain.c Fix common misspellings 2011-03-31 11:26:23 -03:00
fdomain.h
FlashPoint.c Fix common misspellings 2011-03-31 11:26:23 -03:00
g_NCR5380_mmio.c
g_NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
g_NCR5380.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
gdth_ioctl.h
gdth_proc.c [SCSI] gdth: Add missing call to gdth_ioctl_free 2010-12-31 09:50:09 -06:00
gdth_proc.h
gdth.c [SCSI] gdth: Add missing call to gdth_ioctl_free 2010-12-31 09:50:09 -06:00
gdth.h Fix common misspellings 2011-03-31 11:26:23 -03:00
gvp11.c Fix common misspellings 2011-03-31 11:26:23 -03:00
gvp11.h
hosts.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2010-10-22 19:36:42 -07:00
hpsa_cmd.h [SCSI] hpsa: Inform controller we are using 32-bit tags. 2011-02-18 12:33:52 -06:00
hpsa.c [SCSI] hpsa: export resettable host attribute 2011-03-14 18:44:41 -05:00
hpsa.h [SCSI] hpsa: make hpsa.hpsa_simple_mode=1 module parameter actually work 2011-02-18 12:32:30 -06:00
hptiop.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
hptiop.h
ibmmca.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
imm.c Fix common misspellings 2011-03-31 11:26:23 -03:00
imm.h
in2000.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
in2000.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
initio.c Fix common misspellings 2011-03-31 11:26:23 -03:00
initio.h Fix common misspellings 2011-03-31 11:26:23 -03:00
ipr.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
ipr.h [SCSI] ipr: fix mailbox register definition and add a delay before reading 2010-12-21 12:23:55 -06:00
ips.c Fix common misspellings 2011-03-31 11:26:23 -03:00
ips.h Fix common misspellings 2011-03-31 11:26:23 -03:00
iscsi_boot_sysfs.c
iscsi_tcp.c Fix common misspellings 2011-03-31 11:26:23 -03:00
iscsi_tcp.h [SCSI] iscsi_tcp: use iscsi_conn_get_addr_param libiscsi function 2011-02-24 12:41:10 -05:00
jazz_esp.c
Kconfig [SCSI] bnx2fc: Broadcom FCoE offload driver 2011-02-28 18:40:27 -06:00
lasi700.c
libiscsi_tcp.c [SCSI] libiscsi_tcp: use kmap in xmit path 2011-03-23 11:36:58 -05:00
libiscsi.c [SCSI] libiscsi: add helper to convert addr to string 2011-02-24 12:41:08 -05:00
libsrp.c
mac53c94.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
mac53c94.h
mac_esp.c
mac_scsi.c
mac_scsi.h
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
megaraid.c Fix common misspellings 2011-03-31 11:26:23 -03:00
megaraid.h Fix common misspellings 2011-03-31 11:26:23 -03:00
mesh.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
mesh.h
mvme16x_scsi.c
mvme147.c
mvme147.h
ncr53c8xx.c Fix common misspellings 2011-03-31 11:26:23 -03:00
ncr53c8xx.h
NCR53c406a.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
NCR5380.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
NCR_D700.c
NCR_D700.h
NCR_Q720.c
NCR_Q720.h
nsp32_debug.c
nsp32_io.h
nsp32.c Fix common misspellings 2011-03-31 11:26:23 -03:00
nsp32.h Fix common misspellings 2011-03-31 11:26:23 -03:00
osst_detect.h
osst_options.h
osst.c Fix common misspellings 2011-03-31 11:26:23 -03:00
osst.h Fix common misspellings 2011-03-31 11:26:23 -03:00
pas16.c
pas16.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
pmcraid.c [SCSI] pmcraid: reject negative request size 2011-04-24 12:15:07 -05:00
pmcraid.h Fix common misspellings 2011-03-31 11:26:23 -03:00
ppa.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
ppa.h
ps3rom.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
qla1280.c Fix common misspellings 2011-03-31 11:26:23 -03:00
qla1280.h
qlogicfas408.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
qlogicfas408.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
qlogicfas.c
qlogicpti.c dt/sparc: Eliminate users of of_platform_{,un}register_driver 2011-02-28 01:36:39 -07:00
qlogicpti.h
raid_class.c
script_asm.pl
scsi_debug.c Fix common misspellings 2011-03-31 11:26:23 -03:00
scsi_devinfo.c [SCSI] Add scsi_dev_info_list_del_keyed() 2011-01-24 12:01:07 -06:00
scsi_error.c Reduce sequential pointer derefs in scsi_error.c and reduce size as well 2011-03-21 15:54:35 -07:00
scsi_ioctl.c
scsi_lib_dma.c
scsi_lib.c block: get rid of QUEUE_FLAG_REENTER 2011-04-19 13:32:46 +02:00
scsi_logging.h
scsi_module.c
scsi_netlink.c Fix common misspellings 2011-03-31 11:26:23 -03:00
scsi_pm.c
scsi_priv.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
scsi_proc.c
scsi_sas_internal.h
scsi_scan.c driver core: remove CONFIG_SYSFS_DEPRECATED_V2 but keep it for block devices 2010-10-22 10:16:43 -07:00
scsi_sysctl.c
scsi_sysfs.c [SCSI] put stricter guards on queue dead checks 2011-04-24 11:02:17 -05:00
scsi_tgt_if.c Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl 2010-10-22 10:52:56 -07:00
scsi_tgt_lib.c Fix common misspellings 2011-03-31 11:26:23 -03:00
scsi_tgt_priv.h
scsi_trace.c
scsi_transport_api.h
scsi_transport_fc_internal.h
scsi_transport_fc.c block: get rid of QUEUE_FLAG_REENTER 2011-04-19 13:32:46 +02:00
scsi_transport_iscsi.c [SCSI] scsi_transport_iscsi: make priv_sess file writeable only by root 2011-03-23 11:35:58 -05:00
scsi_transport_sas.c block: remove per-queue plugging 2011-03-10 08:52:07 +01:00
scsi_transport_spi.c
scsi_transport_srp_internal.h
scsi_transport_srp.c
scsi_typedefs.h
scsi_wait_scan.c
scsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
scsi.h
scsicam.c
sd_dif.c block: Make the integrity mapped property a bio flag 2010-10-15 15:49:20 +02:00
sd.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sd.h [SCSI] sd: Logical Block Provisioning update 2011-03-14 18:37:34 -05:00
ses.c [SCSI] ses: add subenclosure support 2011-03-23 11:37:09 -05:00
sg.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2010-10-24 13:41:39 -07:00
sgiwd93.c
sim710.c
sni_53c710.c
sr_ioctl.c scsi: replace sr_test_unit_ready() with scsi_test_unit_ready() 2010-12-16 17:53:39 +01:00
sr_vendor.c
sr.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sr.h sr: implement sr_check_events() 2010-12-16 17:53:39 +01:00
st_options.h
st.c [SCSI] st: Increase success probability in driver buffer allocation 2010-12-22 23:26:50 -06:00
st.h
stex.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
sun3_NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sun3_scsi_vme.c
sun3_scsi.c
sun3_scsi.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
sun3x_esp.c
sun_esp.c dt/sparc: Eliminate users of of_platform_{,un}register_driver 2011-02-28 01:36:39 -07:00
sym53c416.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sym53c416.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
t128.c
t128.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
tmscsim.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
tmscsim.h
u14-34f.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
ultrastor.c x86: Stop including <linux/delay.h> in two asm header files 2011-03-29 09:37:42 +02:00
ultrastor.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
vmw_pvscsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
vmw_pvscsi.h
wd33c93.c Fix common misspellings 2011-03-31 11:26:23 -03:00
wd33c93.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
wd7000.c Fix common misspellings 2011-03-31 11:26:23 -03:00
zalon.c
zorro7xx.c