Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-14 07:02:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: lpfc_send_rscn_event sends bigger buffer size

Browse Source 
lpfc_send_rscn_event() allocates data for sizeof(struct
lpfc_rscn_event_header) + payload_len, but claims that the data has size
of sizeof(struct lpfc_els_event_header) + payload_len. That leads to
buffer overruns.

Signed-off-by: Ales Novak <alnovak@suse.cz>
Signed-off-by: James Smart <james.smart@avagotech.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Sebastian Herbszt <herbszt@gmx.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
This commit is contained in:
Ales Novak 2015-08-31 16:48:16 -04:00 committed by James Bottomley
parent db6f1c2f90
commit 6599eaaa45
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/scsi/lpfc/lpfc_els.c
View File

@ -5401,7 +5401,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport,
fc_host_post_vendor_event(shost,
fc_get_event_number(),
sizeof(struct lpfc_els_event_header) + payload_len,
sizeof(struct lpfc_rscn_event_header) + payload_len,
(char *)rscn_event_data,
LPFC_NL_VENDOR_ID);