--- drivers/scsi/mpt2sas/mpt2sas_ctl.c

+++ drivers/scsi/mpt2sas/mpt2sas_ctl.c

@@ -636,6 +636,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPT

data_out_sz = karg.data_out_size;

data_in_sz = karg.data_in_size;

+ /* Check for overflow and wraparound */

+ if (karg.data_sge_offset * 4 > ioc->request_sz ||

+ karg.data_sge_offset > (UINT_MAX / 4)) {

+ ret = -EINVAL;

+ goto out;

+ }

+

/* copy in request message frame from user */

if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {

printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,

@@ -1809,7 +1816,7 @@ _ctl_diag_read_buffer(void __user *arg,

Mpi2DiagBufferPostReply_t *mpi_reply;

int rc, i;

u8 buffer_type;

- unsigned long timeleft;

+ unsigned long timeleft, request_size, copy_size;

u16 smid;

u16 ioc_status;

u8 issue_reset = 0;

@@ -1845,6 +1852,8 @@ _ctl_diag_read_buffer(void __user *arg,

return -ENOMEM;

}

+ request_size = ioc->diag_buffer_sz[buffer_type];

+

if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {

printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "

"or bytes_to_read are not 4 byte aligned\n", ioc->name,

@@ -1852,13 +1861,23 @@ _ctl_diag_read_buffer(void __user *arg,

return -EINVAL;

}

+ if (karg.starting_offset > request_size)

+ return -EINVAL;

+

diag_data = (void *)(request_data + karg.starting_offset);

dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "

"offset(%d), sz(%d)\n", ioc->name, __func__,

diag_data, karg.starting_offset, karg.bytes_to_read));

+ /* Truncate data on requests that are too large */

+ if ((diag_data + karg.bytes_to_read < diag_data) ||

+ (diag_data + karg.bytes_to_read > request_data + request_size))

+ copy_size = request_size - karg.starting_offset;

+ else

+ copy_size = karg.bytes_to_read;

+

if (copy_to_user((void __user *)uarg->diagnostic_data,

- diag_data, karg.bytes_to_read)) {

+ diag_data, copy_size)) {

printk(MPT2SAS_ERR_FMT "%s: Unable to write "

"mpt_diag_read_buffer_t data @ %p\n", ioc->name,

__func__, diag_data);