AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
b5b515445f
kernel_optimize_test/drivers/scsi
History
Dan Rosenberg b5b515445f [SCSI] pmcraid: reject negative request size 
There's a code path in pmcraid that can be reached via device ioctl that
causes all sorts of ugliness, including heap corruption or triggering the
OOM killer due to consecutive allocation of large numbers of pages.

First, the user can call pmcraid_chr_ioctl(), with a type
PMCRAID_PASSTHROUGH_IOCTL.  This calls through to
pmcraid_ioctl_passthrough().  Next, a pmcraid_passthrough_ioctl_buffer
is copied in, and the request_size variable is set to
buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit
signed value provided by the user.  If a negative value is provided
here, bad things can happen.  For example,
pmcraid_build_passthrough_ioadls() is called with this request_size,
which immediately calls pmcraid_alloc_sglist() with a negative size.
The resulting math on allocating a scatter list can result in an
overflow in the kzalloc() call (if num_elem is 0, the sglist will be
smaller than expected), or if num_elem is unexpectedly large the
subsequent loop will call alloc_pages() repeatedly, a high number of
pages will be allocated and the OOM killer might be invoked.

It looks like preventing this value from being negative in
pmcraid_ioctl_passthrough() would be sufficient.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2011-07-27 17:26:21 +04:00
..
aacraid Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 2011-05-26 13:19:00 -07:00
aic7xxx treewide: fix a few typos in comments 2011-05-10 10:16:21 +02:00
aic7xxx_old
aic94xx [SCSI] aic94xx: world-writable sysfs update_bios file 2011-05-24 13:08:39 -04:00
arcmsr [SCSI] arcmsr: simplify assumptions in dma_alloc_coherent() 2011-05-01 16:32:23 -05:00
arm
be2iscsi [SCSI] iscsi_ibft, be2iscsi, iscsi_boot: fix boot kobj data lifetime management 2011-06-29 16:43:06 -05:00
bfa [SCSI] bfa: Update the driver version to 3.0.2.2 2011-07-27 14:59:02 +04:00
bnx2fc [SCSI] bnx2fc: Enable REC & CONF support for the session 2011-07-27 15:38:12 +04:00
bnx2i Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-07-23 11:13:11 -07:00
cxgbi Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-07-23 11:13:11 -07:00
device_handler [SCSI] dh_rdac: Use WWID from C8 page instead of Subsystem id from C4 page to identify storage 2011-07-27 14:29:44 +04:00
dpt
fcoe [SCSI] fcoe: Rearrange fcoe port and NPIV port cleanup 2011-06-29 16:33:25 -05:00
fnic [SCSI] fnic: fix incorrect use of SLAB_CACHE_DMA flag 2011-06-29 16:05:41 -05:00
ibmvscsi [SCSI] ibmvfc: Fix Virtual I/O failover hang 2011-06-29 12:08:39 -05:00
isci [SCSI] isci: fix checkpatch errors 2011-07-03 14:26:24 -05:00
libfc Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-07-23 11:13:11 -07:00
libsas [SCSI] libsas: remove expander from dev list on error 2011-07-27 15:50:58 +04:00
lpfc [SCSI] lpfc 8.3.25: Change driver version to 8.3.25 2011-07-27 15:17:10 +04:00
megaraid [SCSI] megaraid_sas Version to 5.40-rc1 and Changelog update 2011-07-27 15:45:22 +04:00
mpt2sas [SCSI] mpt2sas: WarpDrive Infinite command retries due to wrong scsi command entry in MPI message 2011-07-26 13:56:27 +04:00
mvsas [SCSI] mvsas: Add support for interrupt tasklet 2011-07-26 12:59:55 +04:00
osd
pcmcia Merge git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 2011-05-24 13:28:35 -07:00
pm8001
qla2xxx [SCSI] qla2xxx: Cleanup of previous infrastructure. 2011-07-27 14:16:34 +04:00
qla4xxx Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-05-27 19:52:57 -07:00
sym53c8xx_2
.gitignore
3w-9xxx.c
3w-9xxx.h
3w-sas.c
3w-sas.h
3w-xxxx.c
3w-xxxx.h
53c700_d.h_shipped
53c700.c
53c700.h
53c700.scr
a100u2w.c
a100u2w.h
a2091.c
a2091.h
a3000.c
a3000.h
a4000t.c
advansys.c
aha152x.c [SCSI] aha152x: add missing ISA PNP IDs 2011-06-29 15:09:11 -05:00
aha152x.h
aha1542.c
aha1542.h
aha1740.c
aha1740.h
aic7xxx_old.c
atari_NCR5380.c [SCSI] atari_NCR5380: Provide a dummy NCR5380_exit() 2011-06-29 15:11:21 -05:00
atari_scsi.c [SCSI] atari_NCR5380: Provide a dummy NCR5380_exit() 2011-06-29 15:11:21 -05:00
atari_scsi.h
atp870u.c
atp870u.h
BusLogic.c
BusLogic.h
bvme6000_scsi.c
ch.c
constants.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2011-05-23 09:12:26 -07:00
dc395x.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
dc395x.h
dmx3191d.c
dpt_i2o.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
dpti.h
dtc.c
dtc.h
eata_generic.h
eata_pio.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
eata_pio.h
eata.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
esp_scsi.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2011-05-23 09:12:26 -07:00
esp_scsi.h
fd_mcs.c
fdomain.c
fdomain.h
FlashPoint.c
g_NCR5380_mmio.c
g_NCR5380.c
g_NCR5380.h
gdth_ioctl.h
gdth_proc.c
gdth_proc.h
gdth.c
gdth.h
gvp11.c
gvp11.h
hosts.c
hpsa_cmd.h [SCSI] hpsa: use new doorbell-bit-5 reset method 2011-05-17 11:07:01 +04:00
hpsa.c [SCSI] hpsa: retry commands completing with status of UNSOLICITED_ABORT 2011-07-27 15:35:49 +04:00
hpsa.h [SCSI] hpsa: do not attempt to read from a write-only register 2011-07-27 15:18:26 +04:00
hptiop.c
hptiop.h
ibmmca.c
imm.c
imm.h
in2000.c Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 2011-05-26 13:19:00 -07:00
in2000.h
initio.c
initio.h
ipr.c [SCSI] ipr: fix possible false positive detection of stuck interrupt 2011-05-24 12:37:50 -04:00
ipr.h [SCSI] ipr: Driver version 2.5.2 2011-05-01 12:10:34 -05:00
ips.c
ips.h
iscsi_boot_sysfs.c [SCSI] iscsi_ibft, be2iscsi, iscsi_boot: fix boot kobj data lifetime management 2011-06-29 16:43:06 -05:00
iscsi_tcp.c [SCSI] iscsi_tcp: fix locking around iscsi sk user data 2011-06-29 16:43:08 -05:00
iscsi_tcp.h
jazz_esp.c
Kconfig isci: remove compile-time (Kconfig) silicon configuration 2011-07-03 04:04:45 -07:00
lasi700.c
libiscsi_tcp.c [SCSI] libiscsi_tcp: fix LLD data allocation 2011-06-29 16:43:10 -05:00
libiscsi.c [SCSI] iscsi: Use struct scsi_lun in iscsi structs instead of u8[8] 2011-06-29 16:22:13 -05:00
libsrp.c
mac53c94.c
mac53c94.h
mac_esp.c
mac_scsi.c [SCSI] mac_scsi: Remove unused variable default_instance 2011-06-29 15:12:43 -05:00
mac_scsi.h
Makefile isci: Intel(R) C600 Series Chipset Storage Control Unit Driver 2011-07-02 22:56:22 -07:00
megaraid.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
megaraid.h
mesh.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
mesh.h
mvme16x_scsi.c
mvme147.c
mvme147.h
ncr53c8xx.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
ncr53c8xx.h
NCR53c406a.c
NCR5380.c
NCR5380.h
NCR_D700.c
NCR_D700.h
NCR_Q720.c
NCR_Q720.h
nsp32_debug.c treewide: fix a few typos in comments 2011-05-10 10:16:21 +02:00
nsp32_io.h
nsp32.c
nsp32.h
osst_detect.h
osst_options.h
osst.c [SCSI] osst: fix warning 2011-05-24 13:09:41 -04:00
osst.h
pas16.c
pas16.h
pmcraid.c [SCSI] pmcraid: reject negative request size 2011-07-27 17:26:21 +04:00
pmcraid.h Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 2011-05-26 13:19:00 -07:00
ppa.c
ppa.h
ps3rom.c
qla1280.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
qla1280.h
qlogicfas408.c
qlogicfas408.h
qlogicfas.c
qlogicpti.c drivercore: revert addition of of_match to struct device 2011-05-18 12:32:23 -06:00
qlogicpti.h
raid_class.c
script_asm.pl
scsi_debug.c
scsi_devinfo.c [SCSI] Blacklist Traxdata CDR4120 and IOMEGA Zip drive to avoid lock ups. 2011-06-29 15:08:47 -05:00
scsi_error.c [SCSI] Reduce error recovery time by reducing use of TURs 2011-05-24 12:51:53 -04:00
scsi_ioctl.c
scsi_lib_dma.c
scsi_lib.c [SCSI] scsi_lib: pause between error retries 2011-07-27 14:06:01 +04:00
scsi_logging.h
scsi_module.c
scsi_netlink.c
scsi_pm.c PM / Runtime: Return special error code if runtime PM is disabled 2011-07-02 14:30:10 +02:00
scsi_priv.h
scsi_proc.c scsi: fix scsi_proc new kernel-doc warning 2011-05-28 23:12:11 -07:00
scsi_sas_internal.h
scsi_scan.c [SCSI] Fix oops caused by queue refcounting failure 2011-06-02 18:34:43 +09:00
scsi_sysctl.c
scsi_sysfs.c [SCSI] Fix oops caused by queue refcounting failure 2011-06-02 18:34:43 +09:00
scsi_tgt_if.c
scsi_tgt_lib.c [SCSI] esp, scsi_tgt_lib, fcoe: use list_move() instead of list_del()/list_add() combination 2011-05-01 10:20:10 -05:00
scsi_tgt_priv.h
scsi_trace.c [SCSI] scsi_trace: Decode UNMAP bit in WRITE SAME(10) 2011-05-24 12:38:36 -04:00
scsi_transport_api.h
scsi_transport_fc_internal.h
scsi_transport_fc.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2011-05-20 13:29:52 -07:00
scsi_transport_iscsi.c
scsi_transport_sas.c
scsi_transport_spi.c [SCSI] scsi_transport_spi: Export host width and HBA id 2011-07-26 13:53:50 +04:00
scsi_transport_srp_internal.h
scsi_transport_srp.c
scsi_typedefs.h
scsi_wait_scan.c
scsi.c
scsi.h
scsicam.c
sd_dif.c
sd.c [SCSI] Retrieve the Caching mode page (version 2) 2011-05-24 12:43:52 -04:00
sd.h
ses.c [SCSI] ses: requesting a fault indication 2011-06-29 12:14:25 -05:00
sg.c
sgiwd93.c
sim710.c
sni_53c710.c
sr_ioctl.c
sr_vendor.c
sr.c [SCSI] sr: check_events() ignore GET_EVENT when TUR says otherwise 2011-07-21 14:15:58 -07:00
sr.h [SCSI] sr: check_events() ignore GET_EVENT when TUR says otherwise 2011-07-21 14:15:58 -07:00
st_options.h
st.c
st.h
stex.c
sun3_NCR5380.c [SCSI] sun3: Remove commented out merge_contiguous_buffers 2011-06-29 15:15:05 -05:00
sun3_scsi_vme.c [SCSI] sun3: Add various missing NDEBUG* definitions 2011-06-29 15:14:54 -05:00
sun3_scsi.c [SCSI] sun3: Add various missing NDEBUG* definitions 2011-06-29 15:14:54 -05:00
sun3_scsi.h
sun3x_esp.c
sun_esp.c
sym53c416.c
sym53c416.h
t128.c
t128.h
tmscsim.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
tmscsim.h
u14-34f.c [SCSI] remove cmd->serial_number litter 2011-05-01 10:22:40 -05:00
ultrastor.c [SCSI] Fix Ultrastor asm snippet 2011-05-24 13:25:35 -04:00
ultrastor.h
vmw_pvscsi.c
vmw_pvscsi.h
wd33c93.c Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 2011-05-26 13:19:00 -07:00
wd33c93.h
wd7000.c
zalon.c
zorro7xx.c