diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2016-09-15 16:44:56 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2016-11-20 01:17:37 +0000 |
| commit | 400ce4d1a8ea346d95b36f6c72b993de69f8a0b0 (patch) | |
| tree | f342ff1a773c03eac38c885da613eec8f6e3834b /include/linux/msg.h | |
| parent | dbc969a232a97c001f6c5f7b4b5e0de4dca4fe84 (diff) | |
scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()
commit 7bc2b55a5c030685b399bb65b6baa9ccc3d1f167 upstream.
We need to put an upper bound on "user_len" so the memcpy() doesn't
overflow.
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[bwh: Backported to 3.16:
- Adjust context
- Use literal 1032 insetad of ARCMSR_API_DATA_BUFLEN]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include/linux/msg.h')
0 files changed, 0 insertions, 0 deletions