diff options
| author | Dan Williams <dan.j.williams@intel.com> | 2011-06-17 02:20:35 +0200 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2011-07-03 13:04:51 +0200 |
| commit | 5edc33480c1c363ab361a881f2957b9fba5185cf (patch) | |
| tree | 6725ee62eb2a2c48a2855701e1e8c5bc17d26715 /drivers/scsi | |
| parent | isci: kill device_sequence (diff) | |
| download | linux-5edc33480c1c363ab361a881f2957b9fba5185cf.tar.xz linux-5edc33480c1c363ab361a881f2957b9fba5185cf.zip | |
isci: fix smp response frame overrun
Due to a typo we currently copy way too much when copying over the
response data, but since a request is likely backed by a full page
allocation we don't corrupt live data.
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/isci/request.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c index ebe160c83f91..f4fbca7b1fa3 100644 --- a/drivers/scsi/isci/request.c +++ b/drivers/scsi/isci/request.c @@ -1694,7 +1694,7 @@ scic_sds_io_request_frame_handler(struct scic_sds_request *sci_req, frame_index, &smp_resp); - word_cnt = (sizeof(struct smp_req) - SMP_RESP_HDR_SZ) / + word_cnt = (sizeof(struct smp_resp) - SMP_RESP_HDR_SZ) / sizeof(u32); sci_swab32_cpy(((u8 *) rsp_hdr) + SMP_RESP_HDR_SZ, |