12 Sep
2020
12 Sep
'20
7:20 a.m.
On Tue, Sep 08, 2020 at 11:36:22PM +0200, Arnd Bergmann wrote:
It sounds unwise to let user space pass an unchecked 32-bit offset into a kernel structure in an ioctl. This is an unsigned variable, so checking the upper bound for the size of the structure it points into is sufficient to avoid data corruption, but as the pointer might also be unaligned, it has to be written carefully as well.
While I stumbled over this problem by reading the code, I did not continue checking the function for further problems like it.
Oh, yikes!
Cc: stable@vger.kernel.org
What about a Fixes tag instead?
if (ioc->sense_len) {
/* make sure the pointer is part of the frame */if (ioc->sense_off > (sizeof(union megasas_frame) - sizeof(__le64))) {
No need for the inner braces and please avoid over 80 char lines.
Otherwise looks good:
Reviewed-by: Christoph Hellwig hch@lst.de