[PATCH] scsi: fcoe: sanity check string size for store_ctrl_mode option

From	Colin King <colin.king@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH] scsi: fcoe: sanity check string size for store_ctrl_mode option
Date	2017-03-22 15:10 +0100
Message-ID	<tnP7z-3yz-9@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Colin Ian King <colin.king@canonical.com>

Reading and writing to mode[count - 1] implies the count should not
be less than 1 so add a sanity check for this.

Detected with CoverityScan, CID#1357345 ("Overflowed array index write")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/scsi/fcoe/fcoe_sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/fcoe/fcoe_sysfs.c b/drivers/scsi/fcoe/fcoe_sysfs.c
index 9cf3d56296ab..e298240c728c 100644
--- a/drivers/scsi/fcoe/fcoe_sysfs.c
+++ b/drivers/scsi/fcoe/fcoe_sysfs.c
@@ -288,7 +288,7 @@ static ssize_t store_ctlr_mode(struct device *dev,
 	struct fcoe_ctlr_device *ctlr = dev_to_ctlr(dev);
 	char mode[FCOE_MAX_MODENAME_LEN + 1];
 
-	if (count > FCOE_MAX_MODENAME_LEN)
+	if (count < 1 || count > FCOE_MAX_MODENAME_LEN)
 		return -EINVAL;
 
 	strncpy(mode, buf, count);
-- 
2.11.0

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] scsi: fcoe: sanity check string size for store_ctrl_mode option Colin King <colin.king@canonical.com> - 2017-03-22 15:10 +0100
  Re: [PATCH] scsi: fcoe: sanity check string size for store_ctrl_mode  option Colin Ian King <colin.king@canonical.com> - 2017-03-22 20:50 +0100
    Re: [PATCH] scsi: fcoe: sanity check string size for store_ctrl_mode  option Dan Carpenter <dan.carpenter@oracle.com> - 2017-03-23 12:50 +0100
  Re: [PATCH] scsi: fcoe: sanity check string size for store_ctrl_mode  option Dan Carpenter <dan.carpenter@oracle.com> - 2017-03-22 20:50 +0100

csiph-web