Skip to content

Commit

Permalink
[SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080
Browse files Browse the repository at this point in the history
A negative offset could be used to index before the event buffer and
lead to a security breach.

Signed-off-by: Dave Jones <davej@redhat.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
  • Loading branch information
Dave Jones authored and James Bottomley committed Nov 11, 2009
1 parent 198439e commit 690e744
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/scsi/gdth.c
Original file line number Diff line number Diff line change
Expand Up @@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str *ha, int handle, gdth_evt_str *estr)
eindex = handle;
estr->event_source = 0;

if (eindex >= MAX_EVENTS) {
if (eindex < 0 || eindex >= MAX_EVENTS) {
spin_unlock_irqrestore(&ha->smp_lock, flags);
return eindex;
}
Expand Down

0 comments on commit 690e744

Please sign in to comment.