staging: unisys: fix random memory corruption in visorchannel_write()
authorTim Sell <Timothy.Sell@unisys.com>
Mon, 13 Jul 2015 18:51:24 +0000 (14:51 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Jul 2015 01:36:48 +0000 (18:36 -0700)
commitd253058f490febdfdbe0a0f09a25166c71afd2b3
tree1b425e94001ae1255819964a5ab9e4391f87e130
parentfd012d0def470d6c2e1a441421d00404240e7fec
staging: unisys: fix random memory corruption in visorchannel_write()

visorchannel_write() and it's user visorbus_write_channel() are
exported, so all visorbus function drivers (i.e., drivers that call
visorbus_register_visor_driver()) are potentially affected by the bug.

Because of pointer-arithmetic rules, the address being written to in the
affected code was actually at byte offset:

    sizeof(struct channel_header) * offset

instead of just <offset> bytes as intended.

The bug could cause some very difficult-to-diagnose symptoms.  The
particular problem that led me on this chase was a kernel fault that
would occur during 'insmod visornic' after a previous 'rmmod visornic',
where we would fault during netdev_register_kobject() within
pm_runtime_set_memalloc_noio() while traversing a device list, which
occurred because dev->parent for the visorbus device had become
corrupted.

Fixes: 0abb60c1c ('staging: unisys: visorchannel_write(): Handle...')
Signed-off-by: Tim Sell <Timothy.Sell@unisys.com>
Acked-by: Don Zickus <dzickus@redhat.com>
Signed-off-by: Benjamin Romer <benjamin.romer@unisys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/unisys/visorbus/visorchannel.c