Commit 690e7448 authored Oct 19, 2009 by Dave Jones Committed by James Bottomley Nov 11, 2009

[SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080



A negative offset could be used to index before the event buffer and
lead to a security breach.

Signed-off-by: Dave Jones <davej@redhat.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

parent 198439e4

drivers/scsi/gdth.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str ha, int handle, gdth_evt_str estr)
		eindex = handle;
		estr->event_source = 0;

		if (eindex >= MAX_EVENTS) {
		if (eindex < 0 \|\| eindex >= MAX_EVENTS) {
		spin_unlock_irqrestore(&ha->smp_lock, flags);
		return eindex;
		}

Admin message