Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() 

The "offset" comes from the skb->data that we received.  Here the code
is verifying that "offset + len" is within bounds however it does not
take integer overflows into account.  Use size_add() to be safe.

This would only be an issue on 32bit systems which are probably a very
small percent of the users.  Still, it's worth fixing just for
correctness sake.

Fixes: 42e9a92fe6 ("[SCSI] libfc: A modular Fibre Channel library")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Message-Id: <aNvPMet7TPtM9CY1@stanley.mountain>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Dan Carpenter 2025-09-30 15:38:09 +03:00 committed by Martin K. Petersen
parent 987da233b2
commit 120642726e
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/scsi/libfc/fc_fcp.c
View File

@ -503,7 +503,7 @@ static void fc_fcp_recv_data(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
host_bcode = FC_ERROR; host_bcode = FC_ERROR;
goto err; goto err;
} }
if (offset + len > fsp->data_len) { if (size_add(offset, len) > fsp->data_len) {
/* this should never happen */ /* this should never happen */
if ((fr_flags(fp) & FCPHF_CRC_UNCHECKED) && if ((fr_flags(fp) & FCPHF_CRC_UNCHECKED) &&
fc_frame_crc_check(fp)) fc_frame_crc_check(fp))