Skip to content
Commit f84afbdd authored by Dan Carpenter's avatar Dan Carpenter Committed by Dan Williams
Browse files

libnvdimm: Out of bounds read in __nd_ioctl()



The "cmd" comes from the user and it can be up to 255.  It it's more
than the number of bits in long, it results out of bounds read when we
check test_bit(cmd, &cmd_mask).  The highest valid value for "cmd" is
ND_CMD_CALL (10) so I added a compare against that.

Fixes: 62232e45 ("libnvdimm: control (ioctl) messages for nvdimm_bus and nvdimm devices")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200225162055.amtosfy7m35aivxg@kili.mountain


Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent 01091c49
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment