Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1448068
| From | tom.ty89@gmail.com |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH resend 3/5] libata-scsi: fix overflow in mode page copy |
| Date | 2016-07-21 20:50 +0200 |
| Message-ID | <rXrcJ-2T6-9@gated-at.bofh.it> (permalink) |
| References | <rXrcJ-2T6-3@gated-at.bofh.it> <rXrcJ-2T6-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Tom Yan <tom.ty89@gmail.com>
ata_mselect_*() would initialize a char array for storing a copy of
the current mode page. However, if char was actually signed char,
overflow could occur.
For example, `0xff` from def_control_mpage[] would be "truncated"
to `-1`. This prevented ata_mselect_control() from working at all,
since when it did the read-only bits check, there would always be
a mismatch.
Signed-off-by: Tom Yan <tom.ty89@gmail.com>
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index ac90676..3c93341 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3610,7 +3610,7 @@ static int ata_mselect_caching(struct ata_queued_cmd *qc,
{
struct ata_taskfile *tf = &qc->tf;
struct ata_device *dev = qc->dev;
- char mpage[CACHE_MPAGE_LEN];
+ u8 mpage[CACHE_MPAGE_LEN];
u8 wce;
int i;
@@ -3675,7 +3675,7 @@ static int ata_mselect_control(struct ata_queued_cmd *qc,
const u8 *buf, int len, u16 *fp)
{
struct ata_device *dev = qc->dev;
- char mpage[CONTROL_MPAGE_LEN];
+ u8 mpage[CONTROL_MPAGE_LEN];
u8 d_sense;
int i;
--
2.9.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH resend 2/5] libata-scsi: fix read-only bits checking in ata_mselect_*() tom.ty89@gmail.com - 2016-07-21 20:50 +0200
[PATCH resend 3/5] libata-scsi: fix overflow in mode page copy tom.ty89@gmail.com - 2016-07-21 20:50 +0200
[PATCH resend 4/5] libata-scsi: have all checks done before calling ata_mselect_*() tom.ty89@gmail.com - 2016-07-21 20:50 +0200
Re: [PATCH resend 3/5] libata-scsi: fix overflow in mode page copy Tejun Heo <tj@kernel.org> - 2016-07-21 23:20 +0200
Re: [PATCH resend 3/5] libata-scsi: fix overflow in mode page copy Tom Yan <tom.ty89@gmail.com> - 2016-07-21 23:40 +0200
Re: [PATCH resend 3/5] libata-scsi: fix overflow in mode page copy Tejun Heo <tj@kernel.org> - 2016-07-21 23:50 +0200
[PATCH resend v2 3/5] libata-scsi: use u8 array to store mode page copy tom.ty89@gmail.com - 2016-07-22 01:30 +0200
Re: [PATCH resend v2 3/5] libata-scsi: use u8 array to store mode page copy Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> - 2016-07-22 12:00 +0200
Re: [PATCH resend v2 3/5] libata-scsi: use u8 array to store mode page copy Tom Yan <tom.ty89@gmail.com> - 2016-07-22 20:30 +0200
[PATCH resend v3 3/5] libata-scsi: use u8 array to store mode page copy tom.ty89@gmail.com - 2016-07-22 20:40 +0200
[PATCH resend v2 3/5] libata-scsi: use u8 array to store mode page copy tom.ty89@gmail.com - 2016-07-22 01:40 +0200
Re: [PATCH resend 2/5] libata-scsi: fix read-only bits checking in ata_mselect_*() Tom Yan <tom.ty89@gmail.com> - 2016-07-22 01:30 +0200
[PATCH resend v2 2/5] libata-scsi: fix read-only bits checking in ata_mselect_*() tom.ty89@gmail.com - 2016-07-22 01:30 +0200
[PATCH resend v2 2/5] libata-scsi: fix read-only bits checking in ata_mselect_*() tom.ty89@gmail.com - 2016-07-22 01:40 +0200
csiph-web