[SCSI] scsi_debug: fix map_region and unmap_region oops
map_region and unmap_region could access to invalid memory area since
they don't check the size boundary.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 136329b..b02bdc6 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1991,7 +1991,8 @@
block = lba + alignment;
rem = do_div(block, granularity);
- set_bit(block, map_storep);
+ if (block < map_size)
+ set_bit(block, map_storep);
lba += granularity - rem;
}
@@ -2011,7 +2012,8 @@
block = lba + alignment;
rem = do_div(block, granularity);
- if (rem == 0 && lba + granularity <= end)
+ if (rem == 0 && lba + granularity <= end &&
+ block < map_size)
clear_bit(block, map_storep);
lba += granularity - rem;