diff options
| author | Mikulas Patocka <[email protected]> | 2021-03-26 18:32:32 +0000 |
|---|---|---|
| committer | Mike Snitzer <[email protected]> | 2021-03-26 18:51:50 +0000 |
| commit | 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a (patch) | |
| tree | acb59de82e8576d658a2a2eb47b520c126f87ebd /drivers/usb/cdns3/core.c | |
| parent | dm: don't report "detected capacity change" on device creation (diff) | |
| download | kernel-4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a.tar.gz kernel-4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a.zip | |
dm ioctl: fix out of bounds array access when no devices
If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.
Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.
Signed-off-by: Mikulas Patocka <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
Cc: [email protected]
Signed-off-by: Mike Snitzer <[email protected]>
Diffstat (limited to 'drivers/usb/cdns3/core.c')
0 files changed, 0 insertions, 0 deletions