The patch titled
hptiop: avoid buffer overflow when returning sense data
has been removed from the -mm tree. Its filename was
hptiop-avoid-buffer-overflow-when-returning-sense-data.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: hptiop: avoid buffer overflow when returning sense data
From: HighPoint Linux Team <[EMAIL PROTECTED]>
avoid buffer overflow when returning sense data.
With current adapter firmware the driver is working but future firmware
updates may return sense data larger than 96 bytes, causing overflow on
scp->sense_buffer and a kernel crash.
This fix should be backported to earlier kernels.
Signed-off-by: HighPoint Linux Team <[EMAIL PROTECTED]>
Cc: James Bottomley <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
---
drivers/scsi/hptiop.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff -puN
drivers/scsi/hptiop.c~hptiop-avoid-buffer-overflow-when-returning-sense-data
drivers/scsi/hptiop.c
---
a/drivers/scsi/hptiop.c~hptiop-avoid-buffer-overflow-when-returning-sense-data
+++ a/drivers/scsi/hptiop.c
@@ -375,8 +375,9 @@ static void hptiop_host_request_callback
scp->result = SAM_STAT_CHECK_CONDITION;
memset(&scp->sense_buffer,
0, sizeof(scp->sense_buffer));
- memcpy(&scp->sense_buffer,
- &req->sg_list, le32_to_cpu(req->dataxfer_length));
+ memcpy(&scp->sense_buffer, &req->sg_list,
+ min(sizeof(scp->sense_buffer),
+ le32_to_cpu(req->dataxfer_length)));
break;
default:
_
Patches currently in -mm which might be from [EMAIL PROTECTED] are
origin.patch
git-scsi-misc.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
