projects
/
platform
/
kernel
/
linux-starfive.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
c4607a0
)
scsi: ufs: Fix potential NULL pointer access during memcpy
author
Bean Huo
<beanhuo@micron.com>
Wed, 3 Jun 2020 09:19:57 +0000
(11:19 +0200)
committer
Martin K. Petersen
<martin.petersen@oracle.com>
Tue, 16 Jun 2020 03:17:47 +0000
(23:17 -0400)
If param_offset is not 0, the memcpy length shouldn't be the true
descriptor length.
Link:
https://lore.kernel.org/r/20200603091959.27618-4-huobean@gmail.com
Acked-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/ufs/ufshcd.c
patch
|
blob
|
history
diff --git
a/drivers/scsi/ufs/ufshcd.c
b/drivers/scsi/ufs/ufshcd.c
index
2288950
..
50364a1
100644
(file)
--- a/
drivers/scsi/ufs/ufshcd.c
+++ b/
drivers/scsi/ufs/ufshcd.c
@@
-3223,8
+3223,8
@@
int ufshcd_read_desc_param(struct ufs_hba *hba,
}
/* Check wherher we will not copy more data, than available */
- if (is_kmalloc &&
param_size
> buff_len)
- param_size = buff_len;
+ if (is_kmalloc &&
(param_offset + param_size)
> buff_len)
+ param_size = buff_len
- param_offset
;
if (is_kmalloc)
memcpy(param_read_buf, &desc_buf[param_offset], param_size);