Re: [patch] vhost/scsi: potential memory corruption

2015-02-06 Thread Nicholas A. Bellinger
On Thu, 2015-02-05 at 10:37 +0300, Dan Carpenter wrote: This code in vhost_scsi_make_tpg() is confusing because we limit tpgt to UINT_MAX but the data type of tpg-tport_tpgt and that is a u16. I looked at the context and it turns out that in vhost_scsi_set_endpoint(), tpg-tport_tpgt is used

[patch] vhost/scsi: potential memory corruption

2015-02-04 Thread Dan Carpenter
This code in vhost_scsi_make_tpg() is confusing because we limit tpgt to UINT_MAX but the data type of tpg-tport_tpgt and that is a u16. I looked at the context and it turns out that in vhost_scsi_set_endpoint(), tpg-tport_tpgt is used as an offset into the vs_tpg[] array which has