From: vikas.chaudhary@qlogic.com
To: jbottomley@parallels.com, michaelc@cs.wisc.edu
Cc: linux-scsi@vger.kernel.org, vikas.chaudhary@qlogic.com,
lalit.chandivade@qlogic.com, ravi.anand@qlogic.com,
Manish Rangankar <manish.rangankar@qlogic.com>
Subject: [PATCH 1/5] qla4xxx: Fix memory corruption issue in qla4xxx_ep_connect.
Date: Tue, 7 Aug 2012 07:57:13 -0400 [thread overview]
Message-ID: <1344340637-25526-2-git-send-email-vikas.chaudhary@qlogic.com> (raw)
In-Reply-To: <1344340637-25526-1-git-send-email-vikas.chaudhary@qlogic.com>
From: Manish Rangankar <manish.rangankar@qlogic.com>
In qla4xxx_ep_connect(), qla_ep->dst_addr and dst_addr are type
struct sockaddr. We are copying sizeof(struct sockaddr_in6) bytes
from dst_addr to qla_ep->dst_addr which is 12 bytes larger. This
will cause memory corruption. So we change qla_ep->dst_addr to
struct sockaddr_storage which is of 128 byte, large enough to
hold sizeof(struct sockaddr_in6).
Signed-off-by: Manish Rangankar <manish.rangankar@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
---
drivers/scsi/qla4xxx/ql4_def.h | 2 +-
drivers/scsi/qla4xxx/ql4_mbx.c | 2 +-
drivers/scsi/qla4xxx/ql4_os.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index 7fdba7f..c298ee9 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -752,7 +752,7 @@ struct ql4_task_data {
struct qla_endpoint {
struct Scsi_Host *host;
- struct sockaddr dst_addr;
+ struct sockaddr_storage dst_addr;
};
struct qla_conn {
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index cab8f66..23a10ea 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -1695,7 +1695,7 @@ int qla4xxx_set_param_ddbentry(struct scsi_qla_host *ha,
conn = cls_conn->dd_data;
qla_conn = conn->dd_data;
sess = conn->session;
- dst_addr = &qla_conn->qla_ep->dst_addr;
+ dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
if (dst_addr->sa_family == AF_INET6)
options |= IPV6_DEFAULT_DDB_ENTRY;
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 9da4266..77a969a 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -1366,7 +1366,7 @@ static int qla4xxx_conn_get_param(struct iscsi_cls_conn *cls_conn,
conn = cls_conn->dd_data;
qla_conn = conn->dd_data;
- dst_addr = &qla_conn->qla_ep->dst_addr;
+ dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
switch (param) {
case ISCSI_PARAM_CONN_PORT:
--
1.7.8.GIT
next prev parent reply other threads:[~2012-08-07 12:15 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-07 11:57 [PATCH 0/5] qla4xxx: Updates for scsi "misc" branch vikas.chaudhary
2012-08-07 11:57 ` vikas.chaudhary [this message]
2012-08-07 11:57 ` [PATCH 2/5] qla4xxx: Fix gcc warning for x86 system vikas.chaudhary
2012-08-07 11:57 ` [PATCH 3/5] qla4xxx: Fix multiple conn login event issue during session recovery vikas.chaudhary
2012-08-07 11:57 ` [PATCH 4/5] qla4xxx: Properly handle SCSI underrun while processing status IOCBs vikas.chaudhary
2012-08-07 11:57 ` [PATCH 5/5] qla4xxx: Update driver version to 5.02.00-k19 vikas.chaudhary
2012-08-07 16:52 ` [PATCH 0/5] qla4xxx: Updates for scsi "misc" branch Mike Christie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1344340637-25526-2-git-send-email-vikas.chaudhary@qlogic.com \
--to=vikas.chaudhary@qlogic.com \
--cc=jbottomley@parallels.com \
--cc=lalit.chandivade@qlogic.com \
--cc=linux-scsi@vger.kernel.org \
--cc=manish.rangankar@qlogic.com \
--cc=michaelc@cs.wisc.edu \
--cc=ravi.anand@qlogic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).