Commit 4f43b32f authored by Dan Carpenter's avatar Dan Carpenter Committed by Sasha Levin

libata: array underflow in ata_find_dev()

[ Upstream commit 59a5e266 ]

My static checker complains that "devno" can be negative, meaning that
we read before the start of the loop.  I've looked at the code, and I
think the warning is right.  This come from /proc so it's root only or
it would be quite a quite a serious bug.  The call tree looks like this:

proc_scsi_write() <- gets id and channel from simple_strtoul()
-> scsi_add_single_device() <- calls shost->transportt->user_scan()
   -> ata_scsi_user_scan()
      -> ata_find_dev()
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org # all versions at this point
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent 6e3dfdd8
...@@ -2834,10 +2834,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc) ...@@ -2834,10 +2834,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
static struct ata_device *ata_find_dev(struct ata_port *ap, int devno) static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
{ {
if (!sata_pmp_attached(ap)) { if (!sata_pmp_attached(ap)) {
if (likely(devno < ata_link_max_devices(&ap->link))) if (likely(devno >= 0 &&
devno < ata_link_max_devices(&ap->link)))
return &ap->link.device[devno]; return &ap->link.device[devno];
} else { } else {
if (likely(devno < ap->nr_pmp_links)) if (likely(devno >= 0 &&
devno < ap->nr_pmp_links))
return &ap->pmp_link[devno].device[0]; return &ap->pmp_link[devno].device[0];
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment