q3k
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
linux/drivers/scsi
History
Dan Rosenberg 5f6279da37 [SCSI] pmcraid: reject negative request size 
There's a code path in pmcraid that can be reached via device ioctl that
causes all sorts of ugliness, including heap corruption or triggering
the OOM killer due to consecutive allocation of large numbers of pages.
Not especially relevant from a security perspective, since users must
have CAP_SYS_ADMIN to open the character device.

First, the user can call pmcraid_chr_ioctl() with a type
PMCRAID_PASSTHROUGH_IOCTL.  A pmcraid_passthrough_ioctl_buffer
is copied in, and the request_size variable is set to
buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed
value provided by the user.

If a negative value is provided here, bad things can happen.  For
example, pmcraid_build_passthrough_ioadls() is called with this
request_size, which immediately calls pmcraid_alloc_sglist() with a
negative size.  The resulting math on allocating a scatter list can
result in an overflow in the kzalloc() call (if num_elem is 0, the
sglist will be smaller than expected), or if num_elem is unexpectedly
large the subsequent loop will call alloc_pages() repeatedly, a high
number of pages will be allocated and the OOM killer might be invoked.

Prevent this value from being negative in pmcraid_ioctl_passthrough().

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Cc: Anil Ravindranath <anil_ravindranath@pmc-sierra.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
 		2011-04-24 12:15:07 -05:00
..
aacraid Fix common misspellings 2011-03-31 11:26:23 -03:00
aic7xxx Fix common misspellings 2011-03-31 11:26:23 -03:00
aic7xxx_old Fix common misspellings 2011-03-31 11:26:23 -03:00
aic94xx Fix common misspellings 2011-03-31 11:26:23 -03:00
arcmsr Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
arm Fix common misspellings 2011-03-31 11:26:23 -03:00
be2iscsi Fix common misspellings 2011-03-31 11:26:23 -03:00
bfa Fix common misspellings 2011-03-31 11:26:23 -03:00
bnx2fc Fix common misspellings 2011-03-31 11:26:23 -03:00
bnx2i Fix common misspellings 2011-03-31 11:26:23 -03:00
cxgbi Fix common misspellings 2011-03-31 11:26:23 -03:00
device_handler [SCSI] scsi_dh: fix reference counting in scsi_dh_activate error path 2011-04-24 11:02:09 -05:00
dpt Fix common misspellings 2011-03-31 11:26:23 -03:00
fcoe Fix common misspellings 2011-03-31 11:26:23 -03:00
fnic Fix common misspellings 2011-03-31 11:26:23 -03:00
ibmvscsi [SCSI] ibmvfc: Improve ibmvfc_async_desc memory layout 2010-12-21 12:24:49 -06:00
libfc Fix common misspellings 2011-03-31 11:26:23 -03:00
libsas Fix common misspellings 2011-03-31 11:26:23 -03:00
lpfc Fix common misspellings 2011-03-31 11:26:23 -03:00
megaraid Fix common misspellings 2011-03-31 11:26:23 -03:00
mpt2sas [SCSI] mpt2sas: prevent heap overflows and unchecked reads 2011-04-24 11:01:59 -05:00
mvsas [SCSI] mvsas: Add support for HighPoint RR27xx series HBA 2011-03-23 11:35:59 -05:00
osd [SCSI] libosd: osd_req_read_sg, optimize the single entry case 2011-01-24 12:06:31 -06:00
pcmcia Fix common misspellings 2011-03-31 11:26:23 -03:00
pm8001 Fix common misspellings 2011-03-31 11:26:23 -03:00
qla2xxx Fix common misspellings 2011-03-31 11:26:23 -03:00
qla4xxx Fix common misspellings 2011-03-31 11:26:23 -03:00
sym53c8xx_2 Fix common misspellings 2011-03-31 11:26:23 -03:00
.gitignore
…
3w-9xxx.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
3w-9xxx.h Fix common misspellings 2011-03-31 11:26:23 -03:00
3w-sas.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
3w-sas.h
…
3w-xxxx.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
3w-xxxx.h Fix common misspellings 2011-03-31 11:26:23 -03:00
53c700.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
53c700.h
…
53c700.scr Fix common misspellings 2011-03-31 11:26:23 -03:00
53c700_d.h_shipped Fix common misspellings 2011-03-31 11:26:23 -03:00
BusLogic.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
BusLogic.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
FlashPoint.c Fix common misspellings 2011-03-31 11:26:23 -03:00
Kconfig [SCSI] bnx2fc: Broadcom FCoE offload driver 2011-02-28 18:40:27 -06:00
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
NCR53c406a.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
NCR5380.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
NCR_D700.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
NCR_D700.h
…
NCR_Q720.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
NCR_Q720.h
…
a100u2w.c Merge branch 'master' into for-next 2010-12-22 18:57:02 +01:00
a100u2w.h
…
a2091.c m68k/scsi: a2091 - Do not use legacy Scsi_Host.base 2010-05-26 19:51:08 +02:00
a2091.h m68k/scsi: a2091 - Kill a2091_scsiregs typedef 2010-05-26 19:51:07 +02:00
a3000.c m68k/scsi: a3000 - Do not use legacy Scsi_Host.base 2010-05-26 19:51:08 +02:00
a3000.h m68k/scsi: a3000 - Kill a3000_scsiregs typedef 2010-05-26 19:51:07 +02:00
a4000t.c m68k: amiga - A4000T SCSI platform device conversion 2010-05-26 19:51:09 +02:00
advansys.c Fix common misspellings 2011-03-31 11:26:23 -03:00
aha152x.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
aha152x.h
…
aha1542.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
aha1542.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
aha1740.c Fix common misspellings 2011-03-31 11:26:23 -03:00
aha1740.h
…
aic7xxx_old.c Fix common misspellings 2011-03-31 11:26:23 -03:00
atari_NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
atari_scsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
atari_scsi.h
…
atp870u.c Fix common misspellings 2011-03-31 11:26:23 -03:00
atp870u.h
…
bvme6000_scsi.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
ch.c Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl 2010-10-22 10:52:56 -07:00
constants.c [SCSI] Fix warning: zero-length gnu_printf format string 2010-09-02 17:15:31 -03:00
dc395x.c Fix common misspellings 2011-03-31 11:26:23 -03:00
dc395x.h Fix common misspellings 2011-03-31 11:26:23 -03:00
dmx3191d.c tree-wide: fix misspelling of "definition" in comments 2009-12-04 23:41:47 +01:00
dpt_i2o.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
dpti.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
dtc.c
…
dtc.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
eata.c Fix common misspellings 2011-03-31 11:26:23 -03:00
eata_generic.h
…
eata_pio.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
eata_pio.h
…
esp_scsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
esp_scsi.h
…
fd_mcs.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
fdomain.c Fix common misspellings 2011-03-31 11:26:23 -03:00
fdomain.h
…
g_NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
g_NCR5380.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
g_NCR5380_mmio.c
…
gdth.c [SCSI] gdth: Add missing call to gdth_ioctl_free 2010-12-31 09:50:09 -06:00
gdth.h Fix common misspellings 2011-03-31 11:26:23 -03:00
gdth_ioctl.h [SCSI] gdth: Convert to use regular kernel types. 2010-01-18 10:48:16 -06:00
gdth_proc.c [SCSI] gdth: Add missing call to gdth_ioctl_free 2010-12-31 09:50:09 -06:00
gdth_proc.h [SCSI] gdth: Convert to use regular kernel types. 2010-01-18 10:48:16 -06:00
gvp11.c Fix common misspellings 2011-03-31 11:26:23 -03:00
gvp11.h m68k: amiga - GVP Series II SCSI zorro_driver conversion 2010-05-26 19:51:08 +02:00
hosts.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2010-10-22 19:36:42 -07:00
hpsa.c [SCSI] hpsa: export resettable host attribute 2011-03-14 18:44:41 -05:00
hpsa.h [SCSI] hpsa: make hpsa.hpsa_simple_mode=1 module parameter actually work 2011-02-18 12:32:30 -06:00
hpsa_cmd.h [SCSI] hpsa: Inform controller we are using 32-bit tags. 2011-02-18 12:33:52 -06:00
hptiop.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
hptiop.h
…
ibmmca.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
imm.c Fix common misspellings 2011-03-31 11:26:23 -03:00
imm.h
…
in2000.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
in2000.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
initio.c Fix common misspellings 2011-03-31 11:26:23 -03:00
initio.h Fix common misspellings 2011-03-31 11:26:23 -03:00
ipr.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
ipr.h [SCSI] ipr: fix mailbox register definition and add a delay before reading 2010-12-21 12:23:55 -06:00
ips.c Fix common misspellings 2011-03-31 11:26:23 -03:00
ips.h Fix common misspellings 2011-03-31 11:26:23 -03:00
iscsi_boot_sysfs.c [SCSI] iscsi boot: mv iscsi_boot_sysfs to drivers/scsi 2010-08-06 10:45:07 -05:00
iscsi_tcp.c Fix common misspellings 2011-03-31 11:26:23 -03:00
iscsi_tcp.h [SCSI] iscsi_tcp: use iscsi_conn_get_addr_param libiscsi function 2011-02-24 12:41:10 -05:00
jazz_esp.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
lasi700.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
libiscsi.c [SCSI] libiscsi: add helper to convert addr to string 2011-02-24 12:41:08 -05:00
libiscsi_tcp.c [SCSI] libiscsi_tcp: use kmap in xmit path 2011-03-23 11:36:58 -05:00
libsrp.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
mac53c94.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
mac53c94.h
…
mac_esp.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
mac_scsi.c
…
mac_scsi.h
…
megaraid.c Fix common misspellings 2011-03-31 11:26:23 -03:00
megaraid.h Fix common misspellings 2011-03-31 11:26:23 -03:00
mesh.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
mesh.h
…
mvme16x_scsi.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
mvme147.c m68k/scsi: mvme147 - Kill obsolete HOSTS_C logic 2010-05-26 19:51:07 +02:00
mvme147.h [SCSI] mvme147: Reindentation 2010-05-02 15:55:03 -04:00
ncr53c8xx.c Fix common misspellings 2011-03-31 11:26:23 -03:00
ncr53c8xx.h
…
nsp32.c Fix common misspellings 2011-03-31 11:26:23 -03:00
nsp32.h Fix common misspellings 2011-03-31 11:26:23 -03:00
nsp32_debug.c
…
nsp32_io.h
…
osst.c Fix common misspellings 2011-03-31 11:26:23 -03:00
osst.h Fix common misspellings 2011-03-31 11:26:23 -03:00
osst_detect.h
…
osst_options.h
…
pas16.c
…
pas16.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
pmcraid.c [SCSI] pmcraid: reject negative request size 2011-04-24 12:15:07 -05:00
pmcraid.h Fix common misspellings 2011-03-31 11:26:23 -03:00
ppa.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
ppa.h
…
ps3rom.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
qla1280.c Fix common misspellings 2011-03-31 11:26:23 -03:00
qla1280.h
…
qlogicfas.c
…
qlogicfas408.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
qlogicfas408.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
qlogicpti.c dt/sparc: Eliminate users of of_platform_{,un}register_driver 2011-02-28 01:36:39 -07:00
qlogicpti.h of/device: Replace struct of_device with struct platform_device 2010-08-06 09:25:50 -06:00
raid_class.c [SCSI] raid_attrs: fix dependency problems 2010-03-03 21:17:06 +05:30
script_asm.pl
…
scsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
scsi.h
…
scsi_debug.c Fix common misspellings 2011-03-31 11:26:23 -03:00
scsi_devinfo.c [SCSI] Add scsi_dev_info_list_del_keyed() 2011-01-24 12:01:07 -06:00
scsi_error.c Reduce sequential pointer derefs in scsi_error.c and reduce size as well 2011-03-21 15:54:35 -07:00
scsi_ioctl.c [SCSI] add scsi target reset support to scsi ioctl 2009-12-04 12:01:33 -06:00
scsi_lib.c block: get rid of QUEUE_FLAG_REENTER 2011-04-19 13:32:46 +02:00
scsi_lib_dma.c [SCSI] scsi_lib_dma: fix bug with dma maps on nested scsi objects 2009-12-04 12:01:30 -06:00
scsi_logging.h
…
scsi_module.c
…
scsi_netlink.c Fix common misspellings 2011-03-31 11:26:23 -03:00
scsi_pm.c [SCSI] implement runtime Power Management 2010-07-28 09:07:50 -05:00
scsi_priv.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-03-17 17:54:40 -07:00
scsi_proc.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
scsi_sas_internal.h [SCSI] scsi_transport_sas: add support for transport layer retries (TLR) 2010-02-08 17:15:19 -06:00
scsi_scan.c driver core: remove CONFIG_SYSFS_DEPRECATED_V2 but keep it for block devices 2010-10-22 10:16:43 -07:00
scsi_sysctl.c
…
scsi_sysfs.c [SCSI] put stricter guards on queue dead checks 2011-04-24 11:02:17 -05:00
scsi_tgt_if.c Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl 2010-10-22 10:52:56 -07:00
scsi_tgt_lib.c Fix common misspellings 2011-03-31 11:26:23 -03:00
scsi_tgt_priv.h
…
scsi_trace.c [SCSI] scsi_trace: Enhance SCSI command tracing 2010-04-30 12:52:08 -05:00
scsi_transport_api.h
…
scsi_transport_fc.c block: get rid of QUEUE_FLAG_REENTER 2011-04-19 13:32:46 +02:00
scsi_transport_fc_internal.h
…
scsi_transport_iscsi.c [SCSI] scsi_transport_iscsi: make priv_sess file writeable only by root 2011-03-23 11:35:58 -05:00
scsi_transport_sas.c block: remove per-queue plugging 2011-03-10 08:52:07 +01:00
scsi_transport_spi.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
scsi_transport_srp.c
…
scsi_transport_srp_internal.h
…
scsi_typedefs.h
…
scsi_wait_scan.c
…
scsicam.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
sd.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sd.h [SCSI] sd: Logical Block Provisioning update 2011-03-14 18:37:34 -05:00
sd_dif.c block: Make the integrity mapped property a bio flag 2010-10-15 15:49:20 +02:00
ses.c [SCSI] ses: add subenclosure support 2011-03-23 11:37:09 -05:00
sg.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2010-10-24 13:41:39 -07:00
sgiwd93.c platform-drivers: move probe to .devinit.text in drivers/scsi 2010-03-07 17:04:50 -08:00
sim710.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
sni_53c710.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
sr.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sr.h sr: implement sr_check_events() 2010-12-16 17:53:39 +01:00
sr_ioctl.c scsi: replace sr_test_unit_ready() with scsi_test_unit_ready() 2010-12-16 17:53:39 +01:00
sr_vendor.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
st.c [SCSI] st: Increase success probability in driver buffer allocation 2010-12-22 23:26:50 -06:00
st.h [SCSI] st: fix mdata->page_order handling 2009-12-10 08:54:13 -06:00
st_options.h
…
stex.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
sun3_NCR5380.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sun3_scsi.c block: remove wrappers for request type/flags 2010-08-07 18:17:56 +02:00
sun3_scsi.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
sun3_scsi_vme.c block: remove wrappers for request type/flags 2010-08-07 18:17:56 +02:00
sun3x_esp.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
sun_esp.c dt/sparc: Eliminate users of of_platform_{,un}register_driver 2011-02-28 01:36:39 -07:00
sym53c416.c Fix common misspellings 2011-03-31 11:26:23 -03:00
sym53c416.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
t128.c
…
t128.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
tmscsim.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
tmscsim.h
…
u14-34f.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
ultrastor.c x86: Stop including <linux/delay.h> in two asm header files 2011-03-29 09:37:42 +02:00
ultrastor.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
vmw_pvscsi.c SCSI host lock push-down 2010-11-16 13:33:23 -08:00
vmw_pvscsi.h
…
wd33c93.c Fix common misspellings 2011-03-31 11:26:23 -03:00
wd33c93.h SCSI host lock push-down 2010-11-16 13:33:23 -08:00
wd7000.c Fix common misspellings 2011-03-31 11:26:23 -03:00
zalon.c
…
zorro7xx.c m68k: amiga - Zorro bus modalias support 2010-05-17 21:37:41 +02:00