diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-04-28 16:19:39 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-25 15:32:48 +0200 |
| commit | 84ef0da8910c97d733fa682198da2f501b3e89e9 (patch) | |
| tree | 623400254a4e18189f3c189bb3986f395189dc63 /drivers/scsi/qedi | |
| parent | b9e3114f7d0c4b1ea4b42fc3a0d06638151087b6 (diff) | |
| download | linux-stable-84ef0da8910c97d733fa682198da2f501b3e89e9.tar.gz linux-stable-84ef0da8910c97d733fa682198da2f501b3e89e9.tar.bz2 linux-stable-84ef0da8910c97d733fa682198da2f501b3e89e9.zip | |
scsi: qedi: Check for buffer overflow in qedi_set_path()
[ Upstream commit 4a4c0cfb4be74e216dd4446b254594707455bfc6 ]
Smatch complains that the "path_data->handle" variable is user controlled.
It comes from iscsi_set_path() so that seems possible. It's harmless to
add a limit check.
The qedi->ep_tbl[] array has qedi->max_active_conns elements (which is
always ISCSI_MAX_SESS_PER_HBA (4096) elements). The array is allocated in
the qedi_cm_alloc_mem() function.
Link: https://lore.kernel.org/r/20200428131939.GA696531@mwanda
Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
Acked-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/scsi/qedi')
| -rw-r--r-- | drivers/scsi/qedi/qedi_iscsi.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c index 1b7049dce169..d59473d1679f 100644 --- a/drivers/scsi/qedi/qedi_iscsi.c +++ b/drivers/scsi/qedi/qedi_iscsi.c @@ -1217,6 +1217,10 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data) } iscsi_cid = (u32)path_data->handle; + if (iscsi_cid >= qedi->max_active_conns) { + ret = -EINVAL; + goto set_path_exit; + } qedi_ep = qedi->ep_tbl[iscsi_cid]; QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO, "iscsi_cid=0x%x, qedi_ep=%p\n", iscsi_cid, qedi_ep); |