[patch 32/40] hptiop: avoid buffer overflow when returning sense data
-stable review patch. If anyone has any objections, please let us know. -- From: HighPoint Linux Team <[EMAIL PROTECTED]> patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline. avoid buffer overflow when returning sense data. With current adapter firmware the driver is working but future firmware updates may return sense data larger than 96 bytes, causing overflow on scp->sense_buffer and a kernel crash. This fix should be backported to earlier kernels. Signed-off-by: HighPoint Linux Team <[EMAIL PROTECTED]> Signed-off-by: James Bottomley <[EMAIL PROTECTED]> Signed-off-by: Andrew Morton <[EMAIL PROTECTED]> Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]> --- drivers/scsi/hptiop.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/scsi/hptiop.c +++ b/drivers/scsi/hptiop.c @@ -365,8 +365,9 @@ static void hptiop_host_request_callback scp->result = SAM_STAT_CHECK_CONDITION; memset(>sense_buffer, 0, sizeof(scp->sense_buffer)); - memcpy(>sense_buffer, - >sg_list, le32_to_cpu(req->dataxfer_length)); + memcpy(>sense_buffer, >sg_list, + min(sizeof(scp->sense_buffer), + le32_to_cpu(req->dataxfer_length))); break; default: -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[patch 32/40] hptiop: avoid buffer overflow when returning sense data
-stable review patch. If anyone has any objections, please let us know. -- From: HighPoint Linux Team [EMAIL PROTECTED] patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline. avoid buffer overflow when returning sense data. With current adapter firmware the driver is working but future firmware updates may return sense data larger than 96 bytes, causing overflow on scp-sense_buffer and a kernel crash. This fix should be backported to earlier kernels. Signed-off-by: HighPoint Linux Team [EMAIL PROTECTED] Signed-off-by: James Bottomley [EMAIL PROTECTED] Signed-off-by: Andrew Morton [EMAIL PROTECTED] Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED] --- drivers/scsi/hptiop.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/scsi/hptiop.c +++ b/drivers/scsi/hptiop.c @@ -365,8 +365,9 @@ static void hptiop_host_request_callback scp-result = SAM_STAT_CHECK_CONDITION; memset(scp-sense_buffer, 0, sizeof(scp-sense_buffer)); - memcpy(scp-sense_buffer, - req-sg_list, le32_to_cpu(req-dataxfer_length)); + memcpy(scp-sense_buffer, req-sg_list, + min(sizeof(scp-sense_buffer), + le32_to_cpu(req-dataxfer_length))); break; default: -- - To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
