Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp1169238yba; Thu, 9 May 2019 11:54:26 -0700 (PDT) X-Google-Smtp-Source: APXvYqw3vld7fB1RMKCu7XWNxZQhGPTP4VyVGVawrs0Jdcj8XcC5leK4aNTMp65J78Ppmiif7rhI X-Received: by 2002:a65:628b:: with SMTP id f11mr7517974pgv.95.1557428066532; Thu, 09 May 2019 11:54:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1557428066; cv=none; d=google.com; s=arc-20160816; b=Mf+19ff8ELfbfvD4Jn9Y14w9juukf1riB3m/qpzDIitIF15rOGcKYQYdjKhE3W1Ya7 +ihUZ16YCbj64JW59XLeXK+YjsucZz9VMJgIlsXUcqUYScaqgVfq1RrTgwEZgB44YVUG GRPlblpnjcAtMOSzheQovC80xXtREMQ/nKlHgDRmdkam9BJaOSlW5je6lb0iWhDIWTJv tkUbJN4HEydueQl6TovoaYrCMJzfnMmClhlW/8eChNps8lL7+hzSt+m9w1uVRdb9WeYv bSdzd+WkccFeL5QYYCGTRhjLPbB/5icBF1EGPXTmv9MKrUdyu469uSc/yJeo0ctRBJUc u+AA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=u1yxcY+VAvS4VSkiNoy48R+e/rZ0CLlRWDoE1MvuKl8=; b=jZ9HYPDYNiU8TQHVUvEjexFLe+2g20k/DLv6a9KSyCTmQY8VogulOV72baGmFdUHLU 93UiVvrPkLaOeJ9WsK1vx+BGGgyQUOjtKZm7Gv+wxLCx3K+9L8q1m+PRwv9nktwf18x6 317lrQcST9VgSWLd1MMJte7MWWaDgHbD9uvzRSKdyS8wcJyerDgGLtmU7bQNvAYqJ2lW VtZQnD3SWMiC7S/TjpCHqIEkqIC76FQe58HnB/BFVuvWGBSRP9HS+SPeSZVW02IKfy91 d0ZUZLAr8/5WQl40hgVgs4cBCFeP8UJFJytTE5Zy0S5v3EQ0itOma8/nX2nIQpFjH1sj W/rA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=AsQiJH2P; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h34si4537971pld.290.2019.05.09.11.54.10; Thu, 09 May 2019 11:54:26 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=AsQiJH2P; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727846AbfEISxY (ORCPT + 99 others); Thu, 9 May 2019 14:53:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:47836 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726998AbfEISxV (ORCPT ); Thu, 9 May 2019 14:53:21 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B0B8020578; Thu, 9 May 2019 18:53:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557428000; bh=AvzCBlu9b21RH+Bn5XnyCH1lsWQ02IjRZ9x6cTTvQXM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AsQiJH2P/SXUMPAXICC+/P2de+u5V6kwquKa9c7oR5eeUOpbuccHpVFNUYE+co3rU gYjBh+qAuxb2OD2piqqKkQnn9WqqqYT2ACG8n9XBUtgWRn2e0KmehYDv2BN7XGinuD EK7hhW1cJer4SawfBfh9r3raeONS4z+UdsSrua3k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Vasquez , Himanshu Madhani , "Martin K. Petersen" Subject: [PATCH 5.0 85/95] scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines Date: Thu, 9 May 2019 20:42:42 +0200 Message-Id: <20190509181315.221891173@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190509181309.180685671@linuxfoundation.org> References: <20190509181309.180685671@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andrew Vasquez commit 5cbdae10bf11f96e30b4d14de7b08c8b490e903c upstream. Commit e6f77540c067 ("scsi: qla2xxx: Fix an integer overflow in sysfs code") incorrectly set 'optrom_region_size' to 'start+size', which can overflow option-rom boundaries when 'start' is non-zero. Continue setting optrom_region_size to the proper adjusted value of 'size'. Fixes: e6f77540c067 ("scsi: qla2xxx: Fix an integer overflow in sysfs code") Cc: stable@vger.kernel.org Signed-off-by: Andrew Vasquez Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/qla2xxx/qla_attr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/scsi/qla2xxx/qla_attr.c +++ b/drivers/scsi/qla2xxx/qla_attr.c @@ -364,7 +364,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi } ha->optrom_region_start = start; - ha->optrom_region_size = start + size; + ha->optrom_region_size = size; ha->optrom_state = QLA_SREADING; ha->optrom_buffer = vmalloc(ha->optrom_region_size); @@ -437,7 +437,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi } ha->optrom_region_start = start; - ha->optrom_region_size = start + size; + ha->optrom_region_size = size; ha->optrom_state = QLA_SWRITING; ha->optrom_buffer = vmalloc(ha->optrom_region_size);