]> git.baikalelectronics.ru Git - kernel.git/commit
[SCSI] aacraid: prevent copy_from_user() BUG!
authorMark Salyzyn <Mark_Salyzyn@adaptec.com>
Wed, 28 May 2008 19:32:55 +0000 (15:32 -0400)
committerJames Bottomley <James.Bottomley@HansenPartnership.com>
Sat, 12 Jul 2008 13:22:24 +0000 (08:22 -0500)
commitad4b5a42caaea2f977dd241ba921b8fa4a17ee8b
tree9663be82ffcdfb6036c9138a94bc966e63d077af
parent5a2d08145a2d74bab35ca913467219a8a2079b3b
[SCSI] aacraid: prevent copy_from_user() BUG!

Seen:

kernel BUG at arch/i386/lib/usercopy.c:872

under a 2.6.18-8.el5 kernel. Traced it to a garbage-in/garbage-out
ioctl condition in the aacraid driver.

Adaptec's special ioctl scb passthrough needs to check the validity of
the individual scatter gather count fields to the maximum the adapter
supports. Doing so will have the side effect of preventing
copy_from_user() from bugging out while populating the dma buffers.
This is a hardening effort, issue was triggered by an errant version
of the management tools and thus the BUG should not be seen in the
field.

[jejb: fixed up compile failure]
Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
drivers/scsi/aacraid/commctrl.c