]> www.infradead.org Git - users/jedix/linux-maple.git/commit
projects / users / jedix / linux-maple.git / commit
summary | shortlog | log | commit | commitdiff | tree
(parent: 9764529) | patch
scsi: sg: check length passed to SG_NEXT_CMD_LEN
authorpeter chang <dpf@google.com>
Wed, 15 Feb 2017 22:11:54 +0000 (14:11 -0800)
committerDhaval Giani <dhaval.giani@oracle.com>
Mon, 29 May 2017 20:29:21 +0000 (16:29 -0400)
commitfe08d51b8951c0ccfcbe3a5df0857a9562896d46
treecec6806c461306236ec86fadbcf778f008c26aebtree
parent9764529f8de2a029f2744e5f95fb9fcf50c13370commit | diff
scsi: sg: check length passed to SG_NEXT_CMD_LEN

Orabug: 25751395
CVE: CVE-2017-7187

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
drivers/scsi/sg.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.