]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blame - releases/2.6.32.1/scsi-megaraid_sas-fix-64-bit-sense-pointer-truncation.patch
drop queue-4.14/mips-make-sure-dt-memory-regions-are-valid.patch
[thirdparty/kernel/stable-queue.git] / releases / 2.6.32.1 / scsi-megaraid_sas-fix-64-bit-sense-pointer-truncation.patch
CommitLineData
e46fb18b
GKH
1From 7b2519afa1abd1b9f63aa1e90879307842422dae Mon Sep 17 00:00:00 2001
2From: Yang, Bo <Bo.Yang@lsi.com>
3Date: Tue, 6 Oct 2009 14:52:20 -0600
4Subject: SCSI: megaraid_sas: fix 64 bit sense pointer truncation
5
6From: Yang, Bo <Bo.Yang@lsi.com>
7
8commit 7b2519afa1abd1b9f63aa1e90879307842422dae upstream.
9
10The current sense pointer is cast to a u32 pointer, which can truncate
11on 64 bits. Fix by using unsigned long instead.
12
13Signed-off-by Bo Yang<bo.yang@lsi.com>
14Signed-off-by: James Bottomley <James.Bottomley@suse.de>
15Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
16
17---
18 drivers/scsi/megaraid/megaraid_sas.c | 8 ++++----
19 1 file changed, 4 insertions(+), 4 deletions(-)
20
21--- a/drivers/scsi/megaraid/megaraid_sas.c
22+++ b/drivers/scsi/megaraid/megaraid_sas.c
23@@ -3032,7 +3032,7 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
24 int error = 0, i;
25 void *sense = NULL;
26 dma_addr_t sense_handle;
27- u32 *sense_ptr;
28+ unsigned long *sense_ptr;
29
30 memset(kbuff_arr, 0, sizeof(kbuff_arr));
31
32@@ -3109,7 +3109,7 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
33 }
34
35 sense_ptr =
36- (u32 *) ((unsigned long)cmd->frame + ioc->sense_off);
37+ (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
38 *sense_ptr = sense_handle;
39 }
40
41@@ -3140,8 +3140,8 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
42 * sense_ptr points to the location that has the user
43 * sense buffer address
44 */
45- sense_ptr = (u32 *) ((unsigned long)ioc->frame.raw +
46- ioc->sense_off);
47+ sense_ptr = (unsigned long *) ((unsigned long)ioc->frame.raw +
48+ ioc->sense_off);
49
50 if (copy_to_user((void __user *)((unsigned long)(*sense_ptr)),
51 sense, ioc->sense_len)) {