aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi/scsi_debug.c
diff options
context:
space:
mode:
authorFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>2010-06-27 12:04:45 -0400
committerJames Bottomley <James.Bottomley@suse.de>2010-07-27 13:03:55 -0400
commit9ab98f57b3e1d73cd0720d29c21b687ba609cde9 (patch)
tree1a6350e608c03b6335bcfc0249bb0b6589f3a06c /drivers/scsi/scsi_debug.c
parent4289a08680d646dcc18e291cb437a292738e504f (diff)
[SCSI] scsi_debug: fix map_region and unmap_region oops
map_region and unmap_region could access to invalid memory area since they don't check the size boundary. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Diffstat (limited to 'drivers/scsi/scsi_debug.c')
-rw-r--r--drivers/scsi/scsi_debug.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 136329b4027b..b02bdc6c2cd1 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1991,7 +1991,8 @@ static void map_region(sector_t lba, unsigned int len)
1991 block = lba + alignment; 1991 block = lba + alignment;
1992 rem = do_div(block, granularity); 1992 rem = do_div(block, granularity);
1993 1993
1994 set_bit(block, map_storep); 1994 if (block < map_size)
1995 set_bit(block, map_storep);
1995 1996
1996 lba += granularity - rem; 1997 lba += granularity - rem;
1997 } 1998 }
@@ -2011,7 +2012,8 @@ static void unmap_region(sector_t lba, unsigned int len)
2011 block = lba + alignment; 2012 block = lba + alignment;
2012 rem = do_div(block, granularity); 2013 rem = do_div(block, granularity);
2013 2014
2014 if (rem == 0 && lba + granularity <= end) 2015 if (rem == 0 && lba + granularity <= end &&
2016 block < map_size)
2015 clear_bit(block, map_storep); 2017 clear_bit(block, map_storep);
2016 2018
2017 lba += granularity - rem; 2019 lba += granularity - rem;