[PATCH] fix: lpfc_send_rscn_event sends bigger buffer size

From	Ales Novak <alnovak@suse.cz>
Newsgroups	linux.kernel
Subject	[PATCH] fix: lpfc_send_rscn_event sends bigger buffer size
Date	2015-08-20 13:40 +0200
Message-ID	<pZwml-3AQ-15@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

lpfc_send_rscn_event() allocates data for sizeof(struct
lpfc_rscn_event_header) + payload_len, but claims that the data has size
of sizeof(struct lpfc_els_event_header) + payload_len. That leads to
buffer overruns.

Signed-off-by: Ales Novak <alnovak@suse.cz>
---
 drivers/scsi/lpfc/lpfc_els.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 36bf58b..136928e 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -5444,7 +5444,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport,
 
 	fc_host_post_vendor_event(shost,
 		fc_get_event_number(),
-		sizeof(struct lpfc_els_event_header) + payload_len,
+		sizeof(struct lpfc_rscn_event_header) + payload_len,
 		(char *)rscn_event_data,
 		LPFC_NL_VENDOR_ID);
 
-- 
2.4.1.168.g1ea28e1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] fix: lpfc_send_rscn_event sends bigger buffer size Ales Novak <alnovak@suse.cz> - 2015-08-20 13:40 +0200
  Re: [PATCH] fix: lpfc_send_rscn_event sends bigger buffer size Hannes Reinecke <hare@suse.de> - 2015-08-26 15:00 +0200

csiph-web