mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-03-15 19:55:32 +00:00
lib/mpi: Fix buffer overrun when SG is too long
[ Upstream commit7361d1bc30
] The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes. Fixes:2d4d1eea54
("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
af27278456
commit
9e7f49a105
1 changed files with 2 additions and 1 deletions
|
@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
|
|||
|
||||
while (sg_miter_next(&miter)) {
|
||||
buff = miter.addr;
|
||||
len = miter.length;
|
||||
len = min_t(unsigned, miter.length, nbytes);
|
||||
nbytes -= len;
|
||||
|
||||
for (x = 0; x < len; x++) {
|
||||
a <<= 8;
|
||||
|
|
Loading…
Add table
Reference in a new issue