Mahesh Rajashekhara b4789b8e6b aacraid: prevent invalid pointer dereference ...

It appears that driver runs into a problem here if fibsize is too small
because we allocate user_srbcmd with fibsize size only but later we
access it until user_srbcmd->sg.count to copy it over to srbcmd.

It is not correct to test (fibsize < sizeof(*user_srbcmd)) because this
structure already includes one sg element and this is not needed for
commands without data.  So, we would recommend to add the following
(instead of test for fibsize == 0).

Signed-off-by: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2013-11-19 16:27:39 -08:00

..

aacraid

aacraid: prevent invalid pointer dereference

2013-11-19 16:27:39 -08:00

aic7xxx

[SCSI] aic7xxx: fix swapped arguments in ahc_find_pci_device

2013-09-10 14:48:16 -07:00

aic7xxx_old

scsi: Spelling hsot -> host

2013-05-28 12:02:12 +02:00

aic94xx

[SCSI] libsas: implement > 16 byte CDB support

2013-06-04 11:15:59 -07:00

arcmsr

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

arm

acornscsi: switch to ->show_info()

2013-04-09 14:13:27 -04:00

be2iscsi

[SCSI] be2iscsi: Bump driver version

2013-10-25 09:58:11 +01:00

bfa

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

bnx2fc

Pull Request for 3.13

2013-11-10 12:19:15 +08:00

bnx2i

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

csiostor

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

cxgbi

treewide: Add __GFP_NOWARN to k.alloc calls with v.alloc fallbacks

2013-08-20 13:06:40 +02:00

device_handler

[SCSI] scsi_dh_alua: ALUA handler attach should succeed while TPG is transitioning

2013-10-25 11:19:33 +01:00

dpt

atomic: use <linux/atomic.h>

2011-07-26 16:49:47 -07:00

esas2r

[SCSI] esas2r: Cleanup snprinf formatting of firmware version

2013-10-25 09:58:59 +01:00

fcoe

SCSI for-linus on 20131110

2013-11-14 12:25:38 +09:00

fnic

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

ibmvscsi

[SCSI] ibmvfc: Fix for offlining devices during error recovery

2013-09-06 11:41:34 -07:00

isci

[SCSI] isci: Fix a infinite loop.

2013-08-26 12:51:30 +04:00

libfc

fcp: Do not interpret check condition as underrun

2013-09-04 13:52:35 -07:00

libsas

[SCSI] libsas: implement > 16 byte CDB support

2013-06-04 11:15:59 -07:00

lpfc

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

megaraid

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

mpt2sas

[SCSI] mpt2sas: Remove phys on topology change.

2013-09-03 07:27:58 -07:00

mpt3sas

[SCSI] Allow MPT Fusion SAS 3.0 driver to be built into the kernel

2013-09-06 11:42:53 -07:00

mvsas

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

osd

SCSI: OSD: convert class code to use dev_groups

2013-07-25 16:34:39 -07:00

pcmcia

nsp_cs: switch to ->show_info()

2013-04-09 14:13:21 -04:00

pm8001

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

qla2xxx

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

qla4xxx

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

sym53c8xx_2

treewide: Fix common typo in "identify"

2013-10-14 15:31:06 +02:00

ufs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

.gitignore

…

3w-9xxx.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

3w-9xxx.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

3w-sas.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

3w-sas.h

…

3w-xxxx.c

[SCSI] 3w-xxxx: Create sense buffer for unsupported commands

2013-06-24 16:32:22 -07:00

3w-xxxx.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

53c700_d.h_shipped

Fix common misspellings

2011-03-31 11:26:23 -03:00

53c700.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

53c700.h

…

53c700.scr

Fix common misspellings

2011-03-31 11:26:23 -03:00

a100u2w.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

a100u2w.h

…

a2091.c

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

a2091.h

…

a3000.c

[SCSI] a3000: use module_platform_driver_probe()

2013-06-24 19:44:18 +02:00

a3000.h

…

a4000t.c

[SCSI] a4000t: use module_platform_driver_probe()

2013-06-24 19:44:18 +02:00

advansys.c

[SCSI] advansys: Remove 'last_reset' references

2013-10-25 11:44:54 +01:00

aha152x.c

aha152x: switch to ->show_info()

2013-04-09 14:13:22 -04:00

aha152x.h

…

aha1542.c

treewide: Put a space between #include and FILE

2012-06-28 11:44:36 +02:00

aha1542.h

…

aha1740.c

aha1740: switch to ->show_info()

2013-04-09 14:13:23 -04:00

aha1740.h

…

aic7xxx_old.c

aix7xxx_old: switch to ->show_info()

2013-04-09 14:13:28 -04:00

atari_NCR5380.c

atari_scsi: switch to ->show_info()

2013-04-09 14:13:29 -04:00

atari_scsi.c

atari_scsi: switch to ->show_info()

2013-04-09 14:13:29 -04:00

atari_scsi.h

atari_scsi: switch to ->show_info()

2013-04-09 14:13:29 -04:00

atp870u.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

atp870u.h

…

BusLogic.c

[SCSI] buslogic: Added check for DMA mapping errors

2013-10-25 09:57:57 +01:00

BusLogic.h

[SCSI] BusLogic: Port driver to 64-bit.

2013-06-26 18:32:47 -07:00

bvme6000_scsi.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

ch.c

scsi: convert to idr_alloc()

2013-02-27 19:10:18 -08:00

constants.c

[SCSI] scsi constants: command, sense key + additional sense strings

2013-07-09 22:52:29 +01:00

dc395x.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

dc395x.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

dmx3191d.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

dpt_i2o.c

[SCSI] dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset

2013-10-25 11:40:42 +01:00

dpti.h

[SCSI] dpt_i2o: Remove DPTI_STATE_IOCTL

2013-10-25 11:36:26 +01:00

dtc.c

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

dtc.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

eata_generic.h

…

eata_pio.c

[SCSI] eata_pio: off by one in eata_pio_detect()

2013-09-03 07:27:58 -07:00

eata_pio.h

…

eata.c

[SCSI] remove cmd->serial_number litter

2011-05-01 10:22:40 -05:00

esp_scsi.c

esp_scsi: Fix tag state corruption when autosensing.

2013-08-01 18:08:34 -07:00

esp_scsi.h

esp_scsi: Fix tag state corruption when autosensing.

2013-08-01 18:08:34 -07:00

fdomain.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

fdomain.h

…

FlashPoint.c

[SCSI] BusLogic: Port driver to 64-bit.

2013-06-26 18:32:47 -07:00

g_NCR5380_mmio.c

…

g_NCR5380.c

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

g_NCR5380.h

…

gdth_ioctl.h

…

gdth_proc.c

gdth: switch to ->show_info()

2013-04-09 14:13:16 -04:00

gdth_proc.h

gdth: switch to ->show_info()

2013-04-09 14:13:16 -04:00

gdth.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

gdth.h

gdth: switch to ->show_info()

2013-04-09 14:13:16 -04:00

gvp11.c

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

gvp11.h

…

hosts.c

[SCSI] Add 'eh_deadline' to limit SCSI EH runtime

2013-10-25 12:17:59 +01:00

hpsa_cmd.h

[SCSI] hpsa: dial down lockup detection during firmware flash

2012-05-10 09:19:39 +01:00

hpsa.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

hpsa.h

[SCSI] hpsa: remove unneeded variable

2013-08-26 12:51:31 +04:00

hptiop.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

hptiop.h

[SCSI] hptiop: Support HighPoint RR4520/RR4522 HBA

2012-11-27 08:59:43 +04:00

imm.c

imm: switch to ->show_info()

2013-04-09 14:13:16 -04:00

imm.h

…

in2000.c

in2000: switch to ->show_info()

2013-04-09 14:13:25 -04:00

in2000.h

…

initio.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

initio.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

ipr.c

[SCSI] ipr: Add sereral new CCIN definitions for new adapters support

2013-08-26 12:51:32 +04:00

ipr.h

[SCSI] ipr: Add sereral new CCIN definitions for new adapters support

2013-08-26 12:51:32 +04:00

ips.c

ips: fix format bugs exposed by previous commit

2013-04-09 14:13:27 -04:00

ips.h

ips: switch to ->show_info()

2013-04-09 14:13:27 -04:00

iscsi_boot_sysfs.c

switch ->is_visible() to returning umode_t

2012-01-03 22:54:55 -05:00

iscsi_tcp.c

[SCSI] iscsi_tcp: consider session state in iscsi_sw_sk_state_check

2013-10-25 09:58:13 +01:00

iscsi_tcp.h

[SCSI] iscsi_tcp: use iscsi_conn_get_addr_param libiscsi function

2011-02-24 12:41:10 -05:00

jazz_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

Kconfig

SCSI misc on 20130903

2013-09-03 15:48:06 -07:00

lasi700.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

libiscsi_tcp.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2013-07-09 18:24:39 -07:00

libiscsi.c

[SCSI] IB/iser: Add Discovery support

2013-08-26 18:53:49 +04:00

libsrp.c

scsi: Fix up files implicitly depending on module.h inclusion

2011-10-31 19:31:24 -04:00

mac53c94.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

mac53c94.h

…

mac_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

mac_scsi.c

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

mac_scsi.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

Makefile

[SCSI] esas2r: ATTO Technology ExpressSAS 6G SAS/SATA RAID Adapter Driver

2013-09-03 07:27:58 -07:00

megaraid.c

PCI: Convert alloc_pci_dev(void) to pci_alloc_dev(bus)

2013-06-05 13:49:36 -06:00

megaraid.h

megaraid: Don't use create_proc_read_entry()

2013-04-29 15:41:57 -04:00

mesh.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

mesh.h

…

mvme16x_scsi.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

mvme147.c

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

mvme147.h

…

mvumi.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

mvumi.h

[SCSI] mvumi: Use PCI_VENDOR_ID_MARVELL_EXT for 0x1b4b

2013-04-15 14:30:44 -06:00

ncr53c8xx.c

treewide: Fix common typo in "identify"

2013-10-14 15:31:06 +02:00

ncr53c8xx.h

…

NCR53c406a.c

…

NCR5380.c

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

NCR5380.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

NCR_D700.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

NCR_D700.h

…

NCR_Q720.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

NCR_Q720.h

…

nsp32_debug.c

treewide: fix a few typos in comments

2011-05-10 10:16:21 +02:00

nsp32_io.h

…

nsp32.c

[SCSI] nsp32: use mdelay instead of large udelay constants

2013-06-19 17:53:35 +02:00

nsp32.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

osst_detect.h

…

osst_options.h

…

osst.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

osst.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

pas16.c

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

pas16.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

pmcraid.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-11-19 15:50:47 -08:00

pmcraid.h

scsi: Fix typo in pmcraid.h

2012-02-21 11:40:37 +01:00

ppa.c

ppa: switch to ->show_info()

2013-04-09 14:13:17 -04:00

ppa.h

…

ps3rom.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

qla1280.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

qla1280.h

…

qlogicfas408.c

…

qlogicfas408.h

…

qlogicfas.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

qlogicpti.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

qlogicpti.h

…

raid_class.c

…

script_asm.pl

…

scsi_debug.c

[SCSI] scsi_debug: fix sparse warnings related to data integrity field

2013-10-25 09:58:12 +01:00

scsi_devinfo.c

[SCSI] Workaround for disks that report bad optimal transfer length

2013-06-24 13:00:10 -07:00

scsi_error.c

[SCSI] scsi_error: Escalate to LUN reset if abort fails

2013-10-25 12:18:30 +01:00

scsi_ioctl.c

…

scsi_lib_dma.c

scsi: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required

2011-10-31 19:31:23 -04:00

scsi_lib.c

ARM: 7796/1: scsi: Use dma_max_pfn(dev) helper for bounce_limit calculations

2013-10-31 14:49:26 +00:00

scsi_logging.h

…

scsi_module.c

…

scsi_netlink.c

scsi: replace obsolete NLMSG_* with type safe nlmsg_*

2013-03-28 14:27:24 -04:00

scsi_pm.c

[SCSI] sd: Add error handling during flushing caches

2013-10-25 09:58:13 +01:00

scsi_priv.h

[SCSI] async: introduce 'async_domain' type

2012-07-20 09:05:54 +01:00

scsi_proc.c

fix buffer leak after "scsi: saner replacements for ->proc_info()"

2013-05-31 15:16:51 -04:00

scsi_sas_internal.h

…

scsi_scan.c

[SCSI] Workaround for disks that report bad optimal transfer length

2013-06-24 13:00:10 -07:00

scsi_sysctl.c

…

scsi_sysfs.c

[SCSI] Add 'eh_deadline' to limit SCSI EH runtime

2013-10-25 12:17:59 +01:00

scsi_tgt_if.c

scsi: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required

2011-10-31 19:31:23 -04:00

scsi_tgt_lib.c

[SCSI] esp, scsi_tgt_lib, fcoe: use list_move() instead of list_del()/list_add() combination

2011-05-01 10:20:10 -05:00

scsi_tgt_priv.h

…

scsi_trace.c

[SCSI] scsi_trace: Decode UNMAP bit in WRITE SAME(10)

2011-05-24 12:38:36 -04:00

scsi_transport_api.h

…

scsi_transport_fc_internal.h

…

scsi_transport_fc.c

drivers: avoid format strings in names passed to alloc_workqueue()

2013-07-03 16:07:41 -07:00

scsi_transport_iscsi.c

[SCSI] scsi_transport_iscsi: Add support to set CHAP entries

2013-10-25 09:58:01 +01:00

scsi_transport_sas.c

[SCSI] scsi_transport_sas: add 12GB definitions for mpt3sas

2012-12-01 10:08:41 +00:00

scsi_transport_spi.c

[SCSI] scsi_transport_spi: fix for unbalanced reference counting

2012-05-10 09:06:12 +01:00

scsi_transport_srp_internal.h

…

scsi_transport_srp.c

scsi_transport_srp: Add periodic reconnect support

2013-11-08 14:43:16 -08:00

scsi_typedefs.h

…

scsi.c

[SCSI] remove check for 'resetting'

2013-10-25 12:00:23 +01:00

scsi.h

…

scsicam.c

fs: move code out of buffer.c

2012-01-03 22:54:07 -05:00

sd_dif.c

[SCSI] sd_dif: problem with verify of type 1 protection information (PI)

2013-05-02 15:37:03 -07:00

sd.c

SCSI for-linus on 20131110

2013-11-14 12:25:38 +09:00

sd.h

[SCSI] Derive the FLUSH_TIMEOUT from the basic I/O timeout

2013-10-25 09:58:16 +01:00

ses.c

[SCSI] ses: requesting a fault indication

2011-06-29 12:14:25 -05:00

sg.c

[SCSI] Revert "sg: use rwsem to solve race during exclusive open"

2013-10-25 10:59:54 +01:00

sgiwd93.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sim710.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sni_53c710.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sr_ioctl.c

scsi: Fix up files implicitly depending on module.h inclusion

2011-10-31 19:31:24 -04:00

sr_vendor.c

…

sr.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

sr.h

[SCSI] sr: check_events() ignore GET_EVENT when TUR says otherwise

2011-07-21 14:15:58 -07:00

st_options.h

…

st.c

[SCSI] st: convert class code to use dev_groups

2013-08-21 10:10:50 -07:00

st.h

[SCSI] st: raise device limit

2012-09-14 17:59:29 +01:00

stex.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

storvsc_drv.c

Drivers: hv: remove HV_DRV_VERSION

2013-08-02 11:34:30 +08:00

sun3_NCR5380.c

sun3_scsi: add ->show_info()

2013-05-04 14:50:16 -04:00

sun3_scsi_vme.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

sun3_scsi.c

sun3_scsi: add ->show_info()

2013-05-04 14:50:16 -04:00

sun3_scsi.h

sun3_scsi: add ->show_info()

2013-05-04 14:50:16 -04:00

sun3x_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sun_esp.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sym53c416.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

sym53c416.h

…

t128.c

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

t128.h

NCR5830: switch to ->show_info()

2013-04-09 14:13:17 -04:00

tmscsim.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-11-15 16:47:22 -08:00

tmscsim.h

[SCSI] tmscsim: Move 'last_reset' into host structure

2013-10-25 11:51:37 +01:00

u14-34f.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

ultrastor.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

ultrastor.h

…

virtio_scsi.c

virtio_scsi: verify if queue is broken after virtqueue_get_buf()

2013-11-11 11:53:26 +10:30

vmw_pvscsi.c

SCSI: remove unnecessary pci_set_drvdata()

2013-10-14 15:26:04 +02:00

vmw_pvscsi.h

[SCSI] vmw_pvscsi: Try setting host->max_id as suggested by the device.

2012-03-27 08:26:36 +01:00

wd33c93.c

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

wd33c93.h

switch wd33c93 to ->show_info()

2013-04-09 14:13:15 -04:00

wd7000.c

wd7000: switch to ->show_info()

2013-04-09 14:13:15 -04:00

zalon.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00

zorro7xx.c

Drivers: scsi: remove __dev* attributes.

2013-01-03 15:57:01 -08:00