[PATCH resend 3/5] libata-scsi: fix overflow in mode page copy
From: <hidden>
Date: 2016-07-21 18:42:44
Also in:
linux-next, linux-scsi, lkml
Subsystem:
libata subsystem (serial and parallel ata drivers), the rest · Maintainers:
Damien Le Moal, Niklas Cassel, Linus Torvalds
From: Tom Yan <redacted> ata_mselect_*() would initialize a char array for storing a copy of the current mode page. However, if char was actually signed char, overflow could occur. For example, `0xff` from def_control_mpage[] would be "truncated" to `-1`. This prevented ata_mselect_control() from working at all, since when it did the read-only bits check, there would always be a mismatch. Signed-off-by: Tom Yan <redacted>
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index ac90676..3c93341 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c@@ -3610,7 +3610,7 @@ static int ata_mselect_caching(struct ata_queued_cmd *qc, { struct ata_taskfile *tf = &qc->tf; struct ata_device *dev = qc->dev; - char mpage[CACHE_MPAGE_LEN]; + u8 mpage[CACHE_MPAGE_LEN]; u8 wce; int i;
@@ -3675,7 +3675,7 @@ static int ata_mselect_control(struct ata_queued_cmd *qc, const u8 *buf, int len, u16 *fp) { struct ata_device *dev = qc->dev; - char mpage[CONTROL_MPAGE_LEN]; + u8 mpage[CONTROL_MPAGE_LEN]; u8 d_sense; int i;
--
2.9.0