2.4.23: possible user/kernel pointer bug in commctrl.c

This code looks very suspicious to me, but I thought I'd get a second
opionion:

In drivers/scsi/aacraid/commctrl.c:aac_send_raw_srb()

line 422:  fibsize is copied from userspace
line 428:  fibsize bytes are copied from userspace

No bounds-checking is done.  CAP_SYS_ADMIN is checked above but this
still looks bad.

Later in the same function:

line 462:  struct sgmap64* psg = (struct sgmap64*)&srbcmd->sg;
line 494:  copy_from_user(p,psg->sg[i].addr,psg->sg[i].count)

Since psg is an sgmap64 (not a regular sgmap), psg->sg[i].addr is an
array of two elements (to hold the upper and lower halves of the
address).  So it looks like this code is just copying the address itself
(and random bytes that follow), not the data pointed to by the address. 
Is this really what was intended?  As it is, it looks like it won't work
at all.

Are these real bugs, or am I just confused?  Thanks for any help.

Best,
Rob


_______________________________________________
Linux-aacraid-devel mailing list
[email protected]
http://lists.us.dell.com/mailman/listinfo/linux-aacraid-devel
Please read the FAQ at http://lists.us.dell.com/faq or search the list archives at http://lists.us.dell.com/htdig/