diff options
| author | Radim Krčmář <rkrcmar@redhat.com> | 2017-09-08 15:40:43 +0300 |
|---|---|---|
| committer | Radim Krčmář <rkrcmar@redhat.com> | 2017-09-08 15:40:43 +0300 |
| commit | 5f54c8b2d4fad95d1f8ecbe023ebe6038e6d3760 (patch) | |
| tree | daca83ea5f9af1bd158504bd0b5af89c5a99b7fa /drivers/scsi/aacraid/aachba.c | |
| parent | 78809a68490d84eb632a215be2121d4b44c86954 (diff) | |
| parent | edd03602d97236e8fea13cd76886c576186aa307 (diff) | |
| download | linux-5f54c8b2d4fad95d1f8ecbe023ebe6038e6d3760.tar.xz | |
Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
This fix was intended for 4.13, but didn't get in because both
maintainers were on vacation.
Paul Mackerras:
"It adds mutual exclusion between list_add_rcu and list_del_rcu calls
on the kvm->arch.spapr_tce_tables list. Without this, userspace could
potentially trigger corruption of the list and cause a host crash or
worse."
Diffstat (limited to 'drivers/scsi/aacraid/aachba.c')
| -rw-r--r-- | drivers/scsi/aacraid/aachba.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c index 707ee2f5954d..4591113c49de 100644 --- a/drivers/scsi/aacraid/aachba.c +++ b/drivers/scsi/aacraid/aachba.c @@ -3198,10 +3198,11 @@ static int query_disk(struct aac_dev *dev, void __user *arg) return -EBUSY; if (copy_from_user(&qd, arg, sizeof (struct aac_query_disk))) return -EFAULT; - if (qd.cnum == -1) + if (qd.cnum == -1) { + if (qd.id < 0 || qd.id >= dev->maximum_num_containers) + return -EINVAL; qd.cnum = qd.id; - else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) - { + } else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) { if (qd.cnum < 0 || qd.cnum >= dev->maximum_num_containers) return -EINVAL; qd.instance = dev->scsi_host_ptr->host_no; |