diff options
| author | Daniel Vetter <daniel.vetter@ffwll.ch> | 2015-09-22 12:02:18 +0300 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2015-09-24 18:18:41 +0300 |
| commit | 646db260b843d2f758559a5483174354c304acf8 (patch) | |
| tree | 73cf06896311567e8fcb75730d4461fd689a3d3f /drivers/message/fusion/mptctl.c | |
| parent | a645654b817feba05e5156345325d19fc85ebc9f (diff) | |
| parent | 1f93e4a96c9109378204c147b3eec0d0e8100fde (diff) | |
| download | linux-646db260b843d2f758559a5483174354c304acf8.tar.xz | |
Merge tag 'v4.3-rc2' into topic/drm-misc
Backmerge Linux 4.3-rc2 because of conflicts in the dp helper code
between bugfixes and new code. Just adjacent lines really.
On top of that there's a silent conflict in the new fsl-dcu driver
merged into 4.3 and
commit 844f9111f6f54f88eb2f0fac121b82ce77193866
Author: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Date: Wed Sep 2 10:42:40 2015 +0200
drm/atomic: Make prepare_fb/cleanup_fb only take state, v3.
which Thierry Reding spotted and provided a fixup for.
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Diffstat (limited to 'drivers/message/fusion/mptctl.c')
| -rw-r--r-- | drivers/message/fusion/mptctl.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c index 70bb7530b22c..fc7393729081 100644 --- a/drivers/message/fusion/mptctl.c +++ b/drivers/message/fusion/mptctl.c @@ -1859,6 +1859,15 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr) } spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags); + /* Basic sanity checks to prevent underflows or integer overflows */ + if (karg.maxReplyBytes < 0 || + karg.dataInSize < 0 || + karg.dataOutSize < 0 || + karg.dataSgeOffset < 0 || + karg.maxSenseBytes < 0 || + karg.dataSgeOffset > ioc->req_sz / 4) + return -EINVAL; + /* Verify that the final request frame will not be too large. */ sz = karg.dataSgeOffset * 4; |