Dave Carroll
fa00c437ee
aacraid: Check size values after double-fetch from user ...
In aacraid's ioctl_send_fib() we do two fetches from userspace, one the
get the fib header's size and one for the fib itself. Later we use the
size field from the second fetch to further process the fib. If for some
reason the size from the second fetch is different than from the first
fix, we may encounter an out-of- bounds access in aac_fib_send(). We
also check the sender size to insure it is not out of bounds. This was
reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was
assigned CVE-2016-6480.
Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Fixes: 7c00ffa31stable@vger.kernel.org
Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2016-08-08 21:34:02 -04:00
aacraid: Check size values after double-fetch from user
2016-08-08 21:34:02 -04:00
aic7xxx: Fix queue depth handling
2016-02-23 21:27:02 -05:00
treewide: Fix typos in printk
2016-04-18 11:23:24 +02:00
arcmsr: change driver version to v1.30.00.22-20151126
2015-11-30 18:51:20 -05:00
scsi: rename SCSI_MAX_{SG, SG_CHAIN}_SEGMENTS
2016-04-15 16:53:14 -04:00
Merge branch 'fixes' into misc
2016-03-15 15:24:44 -07:00
scripts/spelling.txt: add "fimware" misspelling
2016-05-19 19:12:14 -07:00
fcoe: use enum for fip_mode
2016-07-13 22:05:28 -04:00
bnx2i: fix spelling mistake "complection" -> "completion"
2016-07-12 23:16:31 -04:00
scsi: use host wide tags by default
2015-11-09 17:11:57 -08:00
cxgbi: fix uninitialized flowi6
2016-04-25 16:20:49 -04:00
cxlflash: Verify problem state area is mapped before notifying shutdown
2016-07-27 00:32:06 -04:00
Merge branch 'fixes' into misc
2016-05-17 21:12:50 -04:00
scsi: rename SCSI_MAX_{SG, SG_CHAIN}_SEGMENTS
2016-04-15 16:53:14 -04:00
fcoe: Use kfree_skb() instead of kfree()
2016-08-04 21:29:02 -04:00
fnic: pci_dma_mapping_error() doesn't return an error code
2016-07-20 20:49:17 -04:00
hisi_sas: update driver version to 1.5
2016-07-12 23:16:31 -04:00
ibmvfc: prevent a potential deadlock
2016-07-15 15:13:52 -04:00
Merge branch 'for-4.7-zac' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
2016-05-23 17:53:39 -07:00
libfc: sanity check cpu number extracted from xid
2016-07-13 21:49:57 -04:00
scsi:libsas: fix oops caused by assigning a freed task to ->lldd_task
2016-07-20 20:53:35 -04:00
lpfc: Fix possible NULL pointer dereference
2016-08-02 01:16:28 -04:00
megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do not support it
2016-07-13 22:28:56 -04:00
mpt3sas: Fix panic when aer correct error occurred
2016-07-15 15:08:30 -04:00
libata/libsas: Define ATA_CMD_NCQ_NON_DATA
2016-05-09 12:36:44 -04:00
osd: remove deadcode
2016-02-25 21:11:42 -05:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
pm8001: fix typo
2016-07-12 23:16:31 -04:00
qla2xxx: Update driver version to 8.07.00.38-k
2016-07-15 15:35:52 -04:00
scsi: qla4xxx: shut up warning for rd_reg_indirect
2016-02-23 21:27:02 -05:00
snic: Fix use-after-free in case of a dma mapping error
2016-07-12 23:16:31 -04:00
scsi: drop reason argument from ->change_queue_depth
2014-11-24 14:45:27 +01:00
scsi: ufs: remove unnecessary goto label
2016-07-15 15:44:45 -04:00
3w-9xxx: don't unmap bounce buffered commands
2015-10-07 10:24:48 -07:00
3w-9xxx: fix command completion race
2015-04-27 10:10:19 -07:00
3w-sas: fix command completion race
2015-04-27 10:04:39 -07:00
3w-sas: fix command completion race
2015-04-27 10:04:39 -07:00
3w-xxxx: Pass through compat mode ioctls
2016-01-08 12:51:03 -05:00
3w-xxxx: fix command completion race
2015-04-27 10:05:55 -07:00
scsi: remove current_cmnd field from struct scsi_device
2016-07-13 22:33:23 -04:00
scsi: remove current_cmnd field from struct scsi_device
2016-07-13 22:33:23 -04:00
scsi: a100u2w: trivial typo in printk
2015-08-07 15:03:42 +02:00
zorro: ZTWO_VADDR() should return "void __iomem *"
2013-11-26 11:09:07 +01:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
Merge branch 'mkp-fixes' into fixes
2015-12-03 09:32:33 -08:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
scsi: aha1542: avoid uninitialized variable warnings
2016-02-23 21:27:02 -05:00
aha1542: fix include guard and remove useless changelog
2015-04-09 18:08:31 -07:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
am53c974: Fix crash during modprobe
2015-04-17 10:13:56 -07:00
atari_scsi: Allow can_queue to be increased for Falcon
2016-04-11 16:57:09 -04:00
atp870u: Introduce atp870_init()
2015-11-25 22:08:55 -05:00
atp870u: Remove scam_on from struct atp_unit
2015-11-25 22:08:52 -05:00
scsi: replace seq_printf with seq_puts
2015-02-02 09:57:45 -08:00
[SCSI] BusLogic: Port driver to 64-bit.
2013-06-26 18:32:47 -07:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2015-04-14 09:50:27 -07:00
scsi: reduce CONFIG_SCSI_CONSTANTS=y impact by 8k
2016-04-11 16:57:09 -04:00
scsi: print single-character strings with seq_putc
2015-02-02 09:57:46 -08:00
ncr5380: Remove DONT_USE_INTR and AUTOPROBE_IRQ macros
2016-04-11 16:57:09 -04:00
dpt_i2o: fix build warning
2016-02-23 21:27:02 -05:00
scsi: use 64-bit LUNs
2014-07-17 22:07:37 +02:00
ncr5380: Remove DONT_USE_INTR and AUTOPROBE_IRQ macros
2016-04-11 16:57:09 -04:00
ncr5380: Merge DMA implementation from atari_NCR5380 core driver
2016-04-11 16:57:09 -04:00
scsi: drop reason argument from ->change_queue_depth
2014-11-24 14:45:27 +01:00
eata_pio: missing break statement
2016-05-10 22:01:07 -04:00
scsi: use host wide tags by default
2015-11-09 17:11:57 -08:00
esp_scsi: correctly detect am53c974
2014-11-24 16:13:16 +01:00
scsi: fdomain: drop fdomain_pci_tbl when built-in
2016-02-23 21:27:02 -05:00
FlashPoint: fix build warning
2015-11-09 16:32:14 -08:00
ncr5380: Update usage documentation
2016-04-11 16:57:09 -04:00
ncr5380: Merge DMA implementation from atari_NCR5380 core driver
2016-04-11 16:57:09 -04:00
gdth: replace struct timeval with ktime_get_real_seconds()
2016-02-25 21:16:49 -05:00
gdth: replace struct timeval with ktime_get_real_seconds()
2016-02-25 21:16:49 -05:00
zorro: ZTWO_VADDR() should return "void __iomem *"
2013-11-26 11:09:07 +01:00
scsi: remove the disable_blk_mq host flag
2016-07-15 15:11:20 -04:00
hpsa: change hpsa_passthru_ioctl timeout
2016-07-15 15:40:54 -04:00
hpsa: correct handling of HBA device removal
2016-04-29 19:08:24 -04:00
hpsa: update copyright information
2016-02-23 21:27:02 -05:00
hptiop: Support HighPoint RR36xx HBAs and Support SAS tape and SAS media changer
2015-08-12 13:14:57 -07:00
hptiop: Support HighPoint RR36xx HBAs and Support SAS tape and SAS media changer
2015-08-12 13:14:57 -07:00
imm: check parport_claim
2016-02-25 21:10:53 -05:00
scsi: print single-character strings with seq_putc
2015-02-02 09:57:46 -08:00
SCSI: initio: remove duplicate module device table
2015-11-20 11:39:03 -05:00
ipr: Fix error return code in ipr_probe_ioa()
2016-08-02 01:19:18 -04:00
ipr: Wait to do async scan until scsi host is initialized
2016-07-27 00:32:07 -04:00
ips: remove pointless #warning
2015-06-02 17:24:54 -07:00
ibft: Expose iBFT acpi header via sysfs
2016-05-16 11:14:29 -04:00
scsi_tcp: block BH in TCP callbacks
2016-05-19 11:36:49 -07:00
iscsi_tcp: Use ahash
2016-01-27 20:36:10 +08:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
scsi: ultrastor.c depends on ISA_DMA_API
2016-07-12 23:16:31 -04:00
libiscsi: Remove set-but-not-used variables
2016-04-11 16:57:09 -04:00
iscsi_tcp: Use ahash
2016-01-27 20:36:10 +08:00
PCI: Remove includes of asm/pci-bridge.h
2016-02-05 16:29:28 -06:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
mac_scsi: Fix pseudo DMA implementation
2016-04-11 16:57:09 -04:00
hisi_sas: Add initial bare main driver
2015-11-25 22:12:51 -05:00
megaraid : use dev_printk when possible
2015-08-26 07:23:04 -07:00
[SCSI] megaraid: simplify internal command handling
2014-03-27 08:26:31 -07:00
PCI: Remove includes of asm/pci-bridge.h
2016-02-05 16:29:28 -06:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
scsi: mvumi: use __maybe_unused to hide pm functions
2016-03-05 17:07:46 -05:00
scsi: drop reason argument from ->change_queue_depth
2014-11-24 14:45:27 +01:00
scsi: Remove CONFIG_SCSI_MULTI_LUN
2014-07-17 22:07:35 +02:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
ncr5380: Call complete_cmd() for disconnected commands on bus reset
2016-04-11 16:57:09 -04:00
mac_scsi: Fix pseudo DMA implementation
2016-04-11 16:57:09 -04:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
scsi: remove scsi_driver owner field
2014-11-24 20:01:28 +01:00
ncr5380: Remove DONT_USE_INTR and AUTOPROBE_IRQ macros
2016-04-11 16:57:09 -04:00
ncr5380: Merge DMA implementation from atari_NCR5380 core driver
2016-04-11 16:57:09 -04:00
SCSI queue for 4.4.
2015-11-12 07:06:18 -05:00
scsi: ppa: use new parport device model
2016-02-23 21:27:02 -05:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
qla1280: Don't allocate 512kb of host tags
2016-04-30 09:25:26 -07:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
qlogicpti: Return correct error code
2016-03-01 20:06:49 -05:00
scsi: remove the disable_blk_mq host flag
2016-07-15 15:11:20 -04:00
scsi: add scsi_set_sense_field_pointer()
2016-04-04 12:07:42 -04:00
scsi_debug: fix sleep in invalid context
2016-07-12 23:16:31 -04:00
SCSI: fix new bug in scsi_dev_info_list string matching
2016-06-29 00:51:31 -04:00
scsi_dh: move 'dh_state' sysfs attribute to generic code
2015-12-02 16:29:19 -05:00
Merge remote-tracking branch 'mkp-scsi/4.7/scsi-fixes' into fixes
2016-06-18 11:59:01 -07:00
scsi: return EAGAIN when resetting a device under EH
2014-11-12 11:16:12 +01:00
scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands
2016-05-22 14:52:45 -04:00
scsi_logging: return void for dev_printk() functions
2015-02-04 08:00:24 -08:00
scsi: simplify scsi_log_(send|completion)
2014-11-12 11:16:05 +01:00
net: Use netlink_ns_capable to verify the permisions of netlink messages
2014-04-24 13:44:54 -04:00
scsi: Set request queue runtime PM status back to active on resume
2016-02-19 10:52:45 -05:00
scsi: disable automatic target scan
2016-04-11 16:57:09 -04:00
scsi: disable automatic target scan
2016-04-11 16:57:09 -04:00
scsi_transport_sas: add 'scsi_target_id' sysfs attribute
2016-03-14 21:05:04 -04:00
scsi: Add intermediate STARGET_REMOVE state to scsi_target_state
2016-04-15 16:51:53 -04:00
scsi: convert use of typedef ctl_table to struct ctl_table
2014-06-06 16:08:16 -07:00
Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"
2016-04-15 16:53:07 -04:00
scsi-trace: define ZBC_IN and ZBC_OUT
2016-04-11 16:57:09 -04:00
scsi_transport_fc: Unexport scsi_is_fc_vport()
2016-04-11 16:57:09 -04:00
scsi_transport_iscsi: Declare local symbols static
2016-04-11 16:57:09 -04:00
scsi: disable automatic target scan
2016-04-11 16:57:09 -04:00
[SCSI] Fix printk typos in drivers/scsi
2015-08-07 14:28:45 +02:00
IB/srp: Avoid using uninitialized variable
2015-07-14 13:20:09 -04:00
scsi: PC partition tables are little endian
2014-11-12 11:15:54 +01:00
sd: Fix rw_max for devices that report an optimal xfer size
2016-06-01 22:07:47 -04:00
sd: Fix rw_max for devices that report an optimal xfer size
2016-06-01 22:07:47 -04:00
block: Consolidate static integrity profile properties
2015-10-21 14:42:38 -06:00
scsi: move Additional Sense Codes to separate file
2016-04-11 16:57:09 -04:00
ses: fix discovery of SATA devices in SAS enclosures
2015-12-18 19:29:50 -08:00
sg: fix dxferp in from_to case
2016-03-14 15:50:25 -04:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
scsi: sim710: fix build warning
2016-02-23 21:27:02 -05:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
SCSI: fix crashes in sd and sr runtime PM
2016-01-26 17:24:16 -08:00
scsi: introduce sdev_prefix_printk()
2014-11-12 11:15:57 +01:00
sr: reduce debug noise in sr_do_ioctl
2015-01-20 19:43:24 +01:00
scsi: Implement sr_printk()
2014-07-17 22:07:39 +02:00
st: clear ILI if Medium Error
2016-04-25 22:08:16 -04:00
st: Remove obsolete scsi_tape.max_pfn
2015-11-18 11:59:09 -05:00
stex: Add S3/S4 support
2016-02-23 21:27:02 -05:00
scsi: storvsc: Filter out storvsc messages CD-ROM medium not present
2016-07-12 23:16:31 -04:00
ncr5380: Remove disused atari_NCR5380.c core driver
2016-04-11 16:57:09 -04:00
sun3_scsi: Move macro definitions
2014-11-20 09:11:15 +01:00
scsi/NCR5380: merge sun3_scsi_vme.c into sun3_scsi.c
2014-05-28 12:16:28 +02:00
arch, drivers: don't include <asm/io.h> directly, use <linux/io.h> instead
2015-08-10 23:07:05 -04:00
scsi: drop owner assignment from platform_drivers
2014-10-20 16:21:33 +02:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
ncr5380: Remove DONT_USE_INTR and AUTOPROBE_IRQ macros
2016-04-11 16:57:09 -04:00
ncr5380: Merge DMA implementation from atari_NCR5380 core driver
2016-04-11 16:57:09 -04:00
scsi: drop reason argument from ->change_queue_depth
2014-11-24 14:45:27 +01:00
virtio/vhost: fixes for 4.2
2015-07-23 13:07:04 -07:00
vmw_pvscsi: Change to update maintainer details (name, email)
2016-07-12 23:16:31 -04:00
vmw_pvscsi: Change to update maintainer details (name, email)
2016-07-12 23:16:31 -04:00
scsi: print single-character strings with seq_putc
2015-02-02 09:57:46 -08:00
[SCSI] Fix printk typos in drivers/scsi
2015-08-07 14:28:45 +02:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
scsi: wd7000: print sector number as 64-bit
2016-07-12 23:16:31 -04:00
xen: Use correctly the Xen memory terminologies
2015-09-08 18:03:49 +01:00
zorro: ZTWO_VADDR() should return "void __iomem *"
2013-11-26 11:09:07 +01:00
fa00c437ee