From: Sebastian Herbszt <herbszt@gmx.de>
To: James Smart <james.smart@avagotech.com>
Cc: linux-scsi@vger.kernel.org
Subject: Re: [PATCH 09/14] fix: lpfc_send_rscn_event sends bigger buffer size
Date: Tue, 1 Sep 2015 23:41:11 +0200 [thread overview]
Message-ID: <20150901234111.00006b62@localhost> (raw)
In-Reply-To: <55e4bd90.zlcxDDRSu3edLd6S%james.smart@avagotech.com>
James Smart wrote:
>
> From: Ales Novak <alnovak@suse.cz>
>
> lpfc_send_rscn_event() allocates data for sizeof(struct
> lpfc_rscn_event_header) + payload_len, but claims that the data has size
> of sizeof(struct lpfc_els_event_header) + payload_len. That leads to
> buffer overruns.
>
> Signed-off-by: Ales Novak <alnovak@suse.cz>
> Signed-off-by: James Smart <james.smart@avagotech.com>
> Reviewed-by: Hannes Reinecke <hare@suse.de>
> ---
> drivers/scsi/lpfc/lpfc_els.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
> index c859aa3..f9c957d 100644
> --- a/drivers/scsi/lpfc/lpfc_els.c
> +++ b/drivers/scsi/lpfc/lpfc_els.c
> @@ -5401,7 +5401,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport,
>
> fc_host_post_vendor_event(shost,
> fc_get_event_number(),
> - sizeof(struct lpfc_els_event_header) + payload_len,
> + sizeof(struct lpfc_rscn_event_header) + payload_len,
> (char *)rscn_event_data,
> LPFC_NL_VENDOR_ID);
>
Reviewed-by: Sebastian Herbszt <herbszt@gmx.de>
prev parent reply other threads:[~2015-09-01 21:41 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-31 20:48 [PATCH 09/14] fix: lpfc_send_rscn_event sends bigger buffer size James Smart
2015-09-01 21:41 ` Sebastian Herbszt [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150901234111.00006b62@localhost \
--to=herbszt@gmx.de \
--cc=james.smart@avagotech.com \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.