]> git.baikalelectronics.ru Git - kernel.git/commit
IB/ipath: Fix potential buffer overrun in sending diag packet routine
authorDennis Dalessandro <dennis.dalessandro@intel.com>
Thu, 20 Feb 2014 16:02:53 +0000 (11:02 -0500)
committerRoland Dreier <roland@purestorage.com>
Mon, 17 Mar 2014 23:16:51 +0000 (16:16 -0700)
commitafc1b12870b2693dfc5ec79f1c9a55ad77c688f6
tree29398a975c31580c9c545df3e8081e566e49f46b
parent8be998be7f506f7ca236111ae3861a9974b9046c
IB/ipath: Fix potential buffer overrun in sending diag packet routine

Guard against a potential buffer overrun.  The size to read from the
user is passed in, and due to the padding that needs to be taken into
account, as well as the place holder for the ICRC it is possible to
overflow the 32bit value which would cause more data to be copied from
user space than is allocated in the buffer.

Cc: <stable@vger.kernel.org>
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
drivers/infiniband/hw/ipath/ipath_diag.c