[PATCH] target: Fix missing length check in spc_emulate_evpd_83()
From: Roland Dreier rol...@purestorage.com Commit fbfe858fea2a (target_core_spc: Include target device descriptor in VPD page 83) added a new length variable, but (due to a cut and paste mistake?) just checks scsi_name_len against 256 twice. Fix this to check scsi_target_len for overflow too. Signed-off-by: Roland Dreier rol...@purestorage.com --- drivers/target/target_core_spc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c index 43c5ca9878bc..3bebc71ea033 100644 --- a/drivers/target/target_core_spc.c +++ b/drivers/target/target_core_spc.c @@ -440,8 +440,8 @@ check_scsi_name: padding = ((-scsi_target_len) 3); if (padding) scsi_target_len += padding; - if (scsi_name_len 256) - scsi_name_len = 256; + if (scsi_target_len 256) + scsi_target_len = 256; buf[off-1] = scsi_target_len; off += scsi_target_len; -- 1.9.rc1 -- To unsubscribe from this list: send the line unsubscribe linux-scsi in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] target: Fix missing length check in spc_emulate_evpd_83()
On Mon, 2014-02-03 at 00:35 -0800, Roland Dreier wrote: From: Roland Dreier rol...@purestorage.com Commit fbfe858fea2a (target_core_spc: Include target device descriptor in VPD page 83) added a new length variable, but (due to a cut and paste mistake?) just checks scsi_name_len against 256 twice. Fix this to check scsi_target_len for overflow too. Signed-off-by: Roland Dreier rol...@purestorage.com --- Applied. Thanks Roland! --nab drivers/target/target_core_spc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c index 43c5ca9878bc..3bebc71ea033 100644 --- a/drivers/target/target_core_spc.c +++ b/drivers/target/target_core_spc.c @@ -440,8 +440,8 @@ check_scsi_name: padding = ((-scsi_target_len) 3); if (padding) scsi_target_len += padding; - if (scsi_name_len 256) - scsi_name_len = 256; + if (scsi_target_len 256) + scsi_target_len = 256; buf[off-1] = scsi_target_len; off += scsi_target_len; -- To unsubscribe from this list: send the line unsubscribe linux-scsi in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
