Re: [PATCH] scsi_debug: fix sanity check in resp_rsup_opcodes

2014-12-22 Thread Ewan Milne 
On Mon, 2014-12-22 at 11:37 -0500, Douglas Gilbert wrote:
> David Binderman pointed out in this post:
> 
> http://marc.info/?l=linux-scsi&m=141924469523474&w=2
> 
> a sanity check that was flawed. See attached fix. Should
> be applied to lk 3.19.0-rc1 and Christoph's branches.
> 
> ChangeLog:
>  fix alloc_len sanity check in resp_rsup_opcodes()
> 
> 
> ---
>   drivers/scsi/scsi_debug.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Signed-off-by: Douglas Gilbert 

Reviewed-by: Ewan D. Milne 


--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] scsi_debug: fix sanity check in resp_rsup_opcodes

2014-12-22 Thread Douglas Gilbert 

David Binderman pointed out in this post:

http://marc.info/?l=linux-scsi&m=141924469523474&w=2

a sanity check that was flawed. See attached fix. Should
be applied to lk 3.19.0-rc1 and Christoph's branches.

ChangeLog:
fix alloc_len sanity check in resp_rsup_opcodes()


---
 drivers/scsi/scsi_debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Signed-off-by: Douglas Gilbert 
>From 89e7ac4920ef22943fe94112221ab3760dc3f763 Mon Sep 17 00:00:00 2001
From: Douglas Gilbert 
Date: Mon, 22 Dec 2014 10:16:55 -0500
Subject: [PATCH] scsi_debug sanity check in resp_rsup_opcodes

fix alloc_len sanity check in resp_rsup_opcodes()
---
 drivers/scsi/scsi_debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 7b8b51b..63a2e1f 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1623,7 +1623,7 @@ resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
 	req_opcode = cmd[3];
 	req_sa = get_unaligned_be16(cmd + 4);
 	alloc_len = get_unaligned_be32(cmd + 6);
-	if (alloc_len < 4 && alloc_len > 0x) {
+	if (alloc_len < 4 || alloc_len > 0x) {
 		mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
 		return check_condition_result;
 	}
-- 
1.9.1