]> www.infradead.org Git - users/jedix/linux-maple.git/commit
s390/qeth: fix length check in SNMP processing
authorJulian Wiedmann <jwi@linux.ibm.com>
Wed, 28 Nov 2018 15:20:50 +0000 (16:20 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 5 Dec 2018 18:41:17 +0000 (19:41 +0100)
commiteb09c6dbe4bb799ba153c5d729e2d26098a3b410
tree42d080708766d00ce73c6df9e23a6f14fd02a5ae
parent47897682fe041a5898cfd30a5f24d3173e856d5a
s390/qeth: fix length check in SNMP processing

[ Upstream commit 9a764c1e59684c0358e16ccaafd870629f2cfe67 ]

The response for a SNMP request can consist of multiple parts, which
the cmd callback stages into a kernel buffer until all parts have been
received. If the callback detects that the staging buffer provides
insufficient space, it bails out with error.
This processing is buggy for the first part of the response - while it
initially checks for a length of 'data_len', it later copies an
additional amount of 'offsetof(struct qeth_snmp_cmd, data)' bytes.

Fix the calculation of 'data_len' for the first part of the response.
This also nicely cleans up the memcpy code.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/s390/net/qeth_core_main.c