diff options
| author | Bart Van Assche <bvanassche@acm.org> | 2021-07-21 20:34:22 -0700 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2021-08-02 21:43:57 -0400 |
| commit | d3d9c4570285090b533b00946b72647361f0345b (patch) | |
| tree | 3ef3cda72f95c1ebd378f720144c9f0b5077063a /drivers/scsi/st_options.h | |
| parent | f95f59a2bb60f917faf516f2f0a679dc4e58f490 (diff) | |
scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
If param_offset > buff_len then the memcpy() statement in
ufshcd_read_desc_param() corrupts memory since it copies 256 + buff_len -
param_offset bytes into a buffer with size buff_len. Since param_offset <
256 this results in writing past the bound of the output buffer.
Link: https://lore.kernel.org/r/20210722033439.26550-2-bvanassche@acm.org
Fixes: cbe193f6f093 ("scsi: ufs: Fix potential NULL pointer access during memcpy")
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/st_options.h')
0 files changed, 0 insertions, 0 deletions