4.16-stable patches

added patches:
	sparc64-properly-range-check-dax-completion-index.patch

diff --git a/queue-4.16/series b/queue-4.16/series
index b5375d8051e316e1cb188af08eb7939bc5d9651e..b0638de35c26ab8b6b37fdb67f8e08988d3e22e2 100644 (file)
--- a/queue-4.16/series
+++ b/queue-4.16/series
@@ -7,3 +7,4 @@ l2tp-fix-race-in-duplicate-tunnel-detection.patch
 ip_gre-clear-feature-flags-when-incompatible-o_flags-are-set.patch
 vhost-fix-vhost_copy_to_user.patch
 lan78xx-correctly-indicate-invalid-otp.patch
+sparc64-properly-range-check-dax-completion-index.patch

diff --git a/queue-4.16/sparc64-properly-range-check-dax-completion-index.patch b/queue-4.16/sparc64-properly-range-check-dax-completion-index.patch
new file mode 100644 (file)
index 0000000..32fbd37
--- /dev/null
+++ b/queue-4.16/sparc64-properly-range-check-dax-completion-index.patch
@@ -0,0 +1,40 @@
+From foo@baz Sat Apr 14 16:04:49 CEST 2018
+From: Rob Gardner <rob.gardner@oracle.com>
+Date: Sat, 31 Mar 2018 22:53:01 -0600
+Subject: [PATCH] sparc64: Properly range check DAX completion index
+
+From: Rob Gardner <rob.gardner@oracle.com>
+
+
+[ Upstream commit 49d7006d9f01d435661d03bbea3db4c33935b3d8 ]
+
+Each Oracle DAX CCB has a corresponding completion area, and the required
+number of areas must fit within a previously allocated array of completion
+areas beginning at the requested index.  Since the completion area index
+is specified by a file offset, a user can pass arbitrary values, including
+negative numbers. So the index must be thoroughly range checked to prevent
+access to addresses outside the bounds of the allocated completion
+area array.  The index cannot be negative, and it cannot exceed the
+total array size, less the number of CCBs requested. The old code did
+not check for negative values and was off by one on the upper bound.
+
+Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
+Signed-off-by: Jonathan Helman <jonathan.helman@oracle.com>
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/sbus/char/oradax.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/sbus/char/oradax.c
++++ b/drivers/sbus/char/oradax.c
+@@ -880,7 +880,7 @@ static int dax_ccb_exec(struct dax_ctx *
+       dax_dbg("args: ccb_buf_len=%ld, idx=%d", count, idx);
+ 
+       /* for given index and length, verify ca_buf range exists */
+-      if (idx + nccbs >= DAX_CA_ELEMS) {
++      if (idx < 0 || idx > (DAX_CA_ELEMS - nccbs)) {
+               ctx->result.exec.status = DAX_SUBMIT_ERR_NO_CA_AVAIL;
+               return 0;
+       }