scsi: bfa: integer overflow in debugfs
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 4 Oct 2017 07:50:37 +0000 (10:50 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Dec 2017 09:10:36 +0000 (10:10 +0100)
commitb197f67ccfeb86d180a152796b5e3b7de1f611ef
tree4cca30111423c3e8222171c1c5e5751b9d9fc0a4
parentdd2581c675e4311abc68826c25ec2563bccb3337
scsi: bfa: integer overflow in debugfs

[ Upstream commit 3e351275655d3c84dc28abf170def9786db5176d ]

We could allocate less memory than intended because we do:

bfad->regdata = kzalloc(len << 2, GFP_KERNEL);

The shift can overflow leading to a crash.  This is debugfs code so the
impact is very small.  I fixed the network version of this in March with
commit 13e2d5187f6b ("bna: integer overflow bug in debugfs").

Fixes: ab2a9ba189e8 ("[SCSI] bfa: add debugfs support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/bfa/bfad_debugfs.c