diff options
| author | Bart Van Assche <[email protected]> | 2021-07-21 20:34:22 -0700 |
|---|---|---|
| committer | Martin K. Petersen <[email protected]> | 2021-08-02 21:43:57 -0400 |
| commit | d3d9c4570285090b533b00946b72647361f0345b (patch) | |
| tree | 3ef3cda72f95c1ebd378f720144c9f0b5077063a /tools/perf/scripts/python | |
| parent | f95f59a2bb60f917faf516f2f0a679dc4e58f490 (diff) | |
scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()
If param_offset > buff_len then the memcpy() statement in
ufshcd_read_desc_param() corrupts memory since it copies 256 + buff_len -
param_offset bytes into a buffer with size buff_len. Since param_offset <
256 this results in writing past the bound of the output buffer.
Link: https://lore.kernel.org/r/[email protected]
Fixes: cbe193f6f093 ("scsi: ufs: Fix potential NULL pointer access during memcpy")
Reviewed-by: Avri Altman <[email protected]>
Reviewed-by: Daejun Park <[email protected]>
Signed-off-by: Bart Van Assche <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions