aboutsummaryrefslogtreecommitdiff
path: root/net/iucv
diff options
context:
space:
mode:
authorDavid Jeffery <djeffery@redhat.com>2009-09-28 13:54:24 -0400
committerJames Bottomley <James.Bottomley@suse.de>2009-10-02 14:11:58 -0500
commit2c2ed8bfd899b84ecbf71d28fcc2cc4ace36c8d9 (patch)
tree890fd3916878e2427141d6e53dd70150ac7ff93e /net/iucv
parent2afc95bf546a961d2936d886c3802e159f1bae6b (diff)
[SCSI] st: fix possible memory use after free after MTSETBLK ioctl
A memory use after free bug can manifest if the MTSETBLK or SET_DENS_AND_BLK ioctl features are used to set the tape's blocksize from 0 to non-zero. After the driver sets the new block size, in this one case it calls normalize_buffer() to free the device's internal data buffers. However, the ioctl code assumes there is always a buffer and does not check or allocate a buffer if there isn't one. So any following ioctl calls can corrupt a part of memory by writing data to memory that the st driver had freed. This patch removes the normalize_buffer() call and the specialness of changing from a 0 to non-zero blocksize to fix the possible use of memory after it has been freed by the st driver. signed-off-by: David Jeffery <djeffery@redhat.com> Acked-by: Kai Makisara <kai.makisara@kolumbus.fi> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Diffstat (limited to 'net/iucv')
0 files changed, 0 insertions, 0 deletions