diff options
| author | Bart Van Assche <bvanassche@acm.org> | 2021-07-22 06:34:22 +0300 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2021-08-03 04:43:57 +0300 |
| commit | d3d9c4570285090b533b00946b72647361f0345b (patch) | |
| tree | 3ef3cda72f95c1ebd378f720144c9f0b5077063a /lib/locking-selftest-hardirq.h | |
| parent | f95f59a2bb60f917faf516f2f0a679dc4e58f490 (diff) | |
| download | linux-d3d9c4570285090b533b00946b72647361f0345b.tar.xz | |
scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
If param_offset > buff_len then the memcpy() statement in
ufshcd_read_desc_param() corrupts memory since it copies 256 + buff_len -
param_offset bytes into a buffer with size buff_len. Since param_offset <
256 this results in writing past the bound of the output buffer.
Link: https://lore.kernel.org/r/20210722033439.26550-2-bvanassche@acm.org
Fixes: cbe193f6f093 ("scsi: ufs: Fix potential NULL pointer access during memcpy")
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'lib/locking-selftest-hardirq.h')
0 files changed, 0 insertions, 0 deletions