Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1764421AbYCUW5n (ORCPT ); Fri, 21 Mar 2008 18:57:43 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1763038AbYCUWuc (ORCPT ); Fri, 21 Mar 2008 18:50:32 -0400 Received: from 216-99-217-87.dsl.aracnet.com ([216.99.217.87]:59210 "EHLO sous-sol.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1763077AbYCUWua (ORCPT ); Fri, 21 Mar 2008 18:50:30 -0400 Message-Id: <20080321224353.846992844@sous-sol.org> References: <20080321224250.144333319@sous-sol.org> User-Agent: quilt/0.46-1 Date: Fri, 21 Mar 2008 15:43:16 -0700 From: Chris Wright To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Alan Stern , Mark Glines , linux-usb@vger.kernel.org, Boaz Harrosh , Greg Kroah-Hartman Subject: [patch 26/76] usb-storage: dont access beyond the end of the sg buffer Content-Disposition: inline; filename=usb-storage-don-t-access-beyond-the-end-of-the-sg-buffer.patch Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2129 Lines: 55 -stable review patch. If anyone has any objections, please let us know. --------------------- From: Alan Stern This patch (as1038) fixes a bug in usb_stor_access_xfer_buf() and usb_stor_set_xfer_buf() (the bug was originally found by Boaz Harrosh): The routine must not attempt to write beyond the end of a scatter-gather list or beyond the number of bytes requested. This is the minimal 2.6.24 equivalent to as1035 + as1037 (7084191d53b224b953c8e1db525ea6c31aca5fc7 "USB: usb-storage: don't access beyond the end of the sg buffer" + 6d512a80c26d87f8599057c86dc920fbfe0aa3aa "usb-storage: update earlier scatter-gather bug fix"). Mark Glines has confirmed that it fixes his problem. Signed-off-by: Alan Stern Cc: Mark Glines Cc: Boaz Harrosh Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman --- drivers/usb/storage/protocol.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/usb/storage/protocol.c +++ b/drivers/usb/storage/protocol.c @@ -194,7 +194,7 @@ unsigned int usb_stor_access_xfer_buf(un * and the starting offset within the page, and update * the *offset and *index values for the next loop. */ cnt = 0; - while (cnt < buflen) { + while (cnt < buflen && sg) { struct page *page = sg_page(sg) + ((sg->offset + *offset) >> PAGE_SHIFT); unsigned int poff = @@ -249,7 +249,8 @@ void usb_stor_set_xfer_buf(unsigned char unsigned int offset = 0; struct scatterlist *sg = NULL; - usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset, + buflen = min(buflen, srb->request_bufflen); + buflen = usb_stor_access_xfer_buf(buffer, buflen, srb, &sg, &offset, TO_XFER_BUF); if (buflen < srb->request_bufflen) srb->resid = srb->request_bufflen - buflen; -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/