| commit | 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707 | [log] [tgz] |
|---|---|---|
| author | Dan Carpenter <dan.carpenter@oracle.com> | Wed Apr 18 12:51:31 2018 +0300 |
| committer | Jens Axboe <axboe@kernel.dk> | Wed Apr 18 08:21:32 2018 -0600 |
| tree | faa7e99e952977ce648ecf83f27821e456823e53 | |
| parent | 72961c4e6082be79825265d9193272b8a1634dec [diff] |
cdrom: information leak in cdrom_ioctl_media_changed() This cast is wrong. "cdi->capacity" is an int and "arg" is an unsigned long. The way the check is written now, if one of the high 32 bits is set then we could read outside the info->slots[] array. This bug is pretty old and it predates git. Reviewed-by: Christoph Hellwig <hch@lst.de> Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>