projects
/
platform
/
kernel
/
linux-starfive.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
414418a
)
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
author
Tomas Henzl
<thenzl@redhat.com>
Thu, 2 Feb 2023 16:24:51 +0000
(17:24 +0100)
committer
Greg Kroah-Hartman
<gregkh@linuxfoundation.org>
Fri, 10 Mar 2023 08:34:29 +0000
(09:34 +0100)
commit
578797f0c8cbc2e3ec5fc0dab87087b4c7073686
upstream.
A fix for:
BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses]
Read of size 8 at addr
ffff88a10d32e5d8
by task rmmod/12013
When edev->components is zero, accessing edev->component[0] members is
wrong.
Link:
https://lore.kernel.org/r/20230202162451.15346-5-thenzl@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/ses.c
patch
|
blob
|
history
diff --git
a/drivers/scsi/ses.c
b/drivers/scsi/ses.c
index
77f4322
..
1707d6d
100644
(file)
--- a/
drivers/scsi/ses.c
+++ b/
drivers/scsi/ses.c
@@
-856,7
+856,8
@@
static void ses_intf_remove_enclosure(struct scsi_device *sdev)
kfree(ses_dev->page2);
kfree(ses_dev);
- kfree(edev->component[0].scratch);
+ if (edev->components)
+ kfree(edev->component[0].scratch);
put_device(&edev->edev);
enclosure_unregister(edev);