scsi: bfa: integer overflow in debugfs
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 4 Oct 2017 07:50:37 +0000 (10:50 +0300)
committerMartin K. Petersen <martin.petersen@oracle.com>
Tue, 17 Oct 2017 02:35:13 +0000 (22:35 -0400)
commit3e351275655d3c84dc28abf170def9786db5176d
tree88f0f09591a36ad920c5020f4293f3fc27c977ae
parent2269848386c4b8395bc67eaaf7d08011da7c07ef
scsi: bfa: integer overflow in debugfs

We could allocate less memory than intended because we do:

bfad->regdata = kzalloc(len << 2, GFP_KERNEL);

The shift can overflow leading to a crash.  This is debugfs code so the
impact is very small.  I fixed the network version of this in March with
commit 13e2d5187f6b ("bna: integer overflow bug in debugfs").

Fixes: ab2a9ba189e8 ("[SCSI] bfa: add debugfs support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/bfa/bfad_debugfs.c