[SCSI] qla4xxx: Fix memory corruption issue in qla4xxx_ep_connect.

In qla4xxx_ep_connect(), qla_ep->dst_addr and dst_addr are type
struct sockaddr. We are copying sizeof(struct sockaddr_in6) bytes
from dst_addr to qla_ep->dst_addr which is 12 bytes larger. This
will cause memory corruption. So we change qla_ep->dst_addr to
struct sockaddr_storage which is of 128 byte, large enough to
hold sizeof(struct sockaddr_in6).

Signed-off-by: Manish Rangankar <manish.rangankar@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index 7fdba7f1ffb70ef68fa1165b716013163a5323c3..c298ee9002f75bf0ad6b7d18b6febebb66edeaca 100644 (file)
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -752,7 +752,7 @@ struct ql4_task_data {
 
 struct qla_endpoint {
        struct Scsi_Host *host;
-       struct sockaddr dst_addr;
+       struct sockaddr_storage dst_addr;
 };
 
 struct qla_conn {

diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index cab8f665a41faca343dba8f404e01ba96075abaf..23a10ead3eb54572b6860f651dc752c562e138e2 100644 (file)
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -1695,7 +1695,7 @@ int qla4xxx_set_param_ddbentry(struct scsi_qla_host *ha,
        conn = cls_conn->dd_data;
        qla_conn = conn->dd_data;
        sess = conn->session;
-       dst_addr = &qla_conn->qla_ep->dst_addr;
+       dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
 
        if (dst_addr->sa_family == AF_INET6)
                options |= IPV6_DEFAULT_DDB_ENTRY;

diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 9da426628b97cc616a258545bf9f2bad8c469537..77a969a4b3756dee4aecd7915c0e7cd93e04badc 100644 (file)
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -1366,7 +1366,7 @@ static int qla4xxx_conn_get_param(struct iscsi_cls_conn *cls_conn,
 
        conn = cls_conn->dd_data;
        qla_conn = conn->dd_data;
-       dst_addr = &qla_conn->qla_ep->dst_addr;
+       dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
 
        switch (param) {
        case ISCSI_PARAM_CONN_PORT: