linux/drivers/sbus/char
Rob Gardner 49d7006d9f sparc64: Properly range check DAX completion index
Each Oracle DAX CCB has a corresponding completion area, and the required
number of areas must fit within a previously allocated array of completion
areas beginning at the requested index.  Since the completion area index
is specified by a file offset, a user can pass arbitrary values, including
negative numbers. So the index must be thoroughly range checked to prevent
access to addresses outside the bounds of the allocated completion
area array.  The index cannot be negative, and it cannot exceed the
total array size, less the number of CCBs requested. The old code did
not check for negative values and was off by one on the upper bound.

Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Jonathan Helman <jonathan.helman@oracle.com>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-04-01 20:07:00 -04:00
..
bbc_envctrl.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bbc_i2c.c sbus: char: drop owner assignment from platform_drivers 2014-10-20 16:21:32 +02:00
bbc_i2c.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
display7seg.c sbus: char: Move D7S_MINOR to include/linux/miscdevice.h 2017-09-27 21:39:22 -07:00
envctrl.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
flash.c sbus: Convert to using %pOF instead of full_name 2017-07-20 12:37:10 -07:00
jsflash.c block: don't set bounce limit in blk_init_queue 2017-06-27 12:13:45 -06:00
Kconfig sparc64: Oracle DAX driver depends on SPARC64 2018-03-18 11:54:05 -04:00
Makefile sparc64: Oracle DAX driver 2018-01-22 08:17:16 -08:00
max1617.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
openprom.c openprom: Deprecate pci_get_bus_and_slot() 2018-01-17 08:16:46 -06:00
oradax.c sparc64: Properly range check DAX completion index 2018-04-01 20:07:00 -04:00
uctrl.c sbus: Convert to using %pOF instead of full_name 2017-07-20 12:37:10 -07:00