]> www.infradead.org Git - users/jedix/linux-maple.git/commit
fix: lpfc_send_rscn_event sends bigger buffer size
authorrkennedy <dick.kennedy@avagotech.com>
Tue, 13 Oct 2015 20:15:21 +0000 (13:15 -0700)
committerChuck Anderson <chuck.anderson@oracle.com>
Mon, 19 Oct 2015 16:10:58 +0000 (09:10 -0700)
commitf54dff58d4d163dbf0ee43e8ce51d24b12fe2772
treea7dd250a6df42c538e22c732e6b3be69e86f0560
parent201606941120550d046fec513c04772b49e666a9
fix: lpfc_send_rscn_event sends bigger buffer size

Submitted by james.smart () james.smart.()@emulex.comSubmitted by Ales Novak Ales.Novak@emulex.com

From: Ales Novak alnovak@suse.cz

lpfc_send_rscn_event() allocates data for sizeof(struct
lpfc_rscn_event_header) + payload_len, but claims that the data has size
of sizeof(struct lpfc_els_event_header) + payload_len. That leads to
buffer overruns.

Signed-off-by: Ales Novak alnovak@suse.cz
Signed-off-by: James Smart james.smart@avagotech.com
Reviewed-by: Hannes Reinecke hare@suse.de
http://marc.info/?l=linux-scsi&m=144105411603743&w=2

Orabug: 22029622
From dick.kennedy@avagotech.com lpfc-10.5.0.1-11.0.0.3-1.tar.gz
Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
drivers/scsi/lpfc/lpfc_els.c