mptfusion: prevent some memory corruption
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 3 Jul 2015 08:53:03 +0000 (11:53 +0300)
committerJames Bottomley <JBottomley@Odin.com>
Wed, 26 Aug 2015 14:11:45 +0000 (07:11 -0700)
commite819cdb198319cccf4af4fc12ac4d796109d8c23
tree5ebde58eb5e51eb6dc52149192e00ff9a13275e4
parent8d6a9f5676f0e734967ac3739f5c6a28a0b047d9
mptfusion: prevent some memory corruption

These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz".  We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
drivers/message/fusion/mptctl.c