scsi: bfa: integer overflow in debugfs
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 4 Oct 2017 07:50:37 +0000 (10:50 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Dec 2017 09:05:01 +0000 (10:05 +0100)
commita114af87c0ba390b0146411f89a2a953ffe3c31f
tree7d66e5a90a72afdf99d8f63bc887b17dd45f4cdc
parent798f085014243bf3239130889f69bb18a71e5a3e
scsi: bfa: integer overflow in debugfs

[ Upstream commit 3e351275655d3c84dc28abf170def9786db5176d ]

We could allocate less memory than intended because we do:

bfad->regdata = kzalloc(len << 2, GFP_KERNEL);

The shift can overflow leading to a crash.  This is debugfs code so the
impact is very small.  I fixed the network version of this in March with
commit 13e2d5187f6b ("bna: integer overflow bug in debugfs").

Fixes: ab2a9ba189e8 ("[SCSI] bfa: add debugfs support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/bfa/bfad_debugfs.c