diff options
| author | Jörn Engel <joern@logfs.org> | 2012-02-16 17:14:27 +0100 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2012-02-25 23:37:50 +0100 |
| commit | 99f730d88fd0a25c3e2dfc357bde4cf6b8cb5b40 (patch) | |
| tree | 94b74e3bbceda90501e550543dfc82f0bde13917 /drivers/target/tcm_fc | |
| parent | target: prevent NULL pointer dereference in target_report_luns (diff) | |
| download | linux-99f730d88fd0a25c3e2dfc357bde4cf6b8cb5b40.tar.xz linux-99f730d88fd0a25c3e2dfc357bde4cf6b8cb5b40.zip | |
target: Fix off-by-seven in target_report_luns
cdb_offset is always equal to offset - 8, so remove that one. More
importantly, the existing code only worked correct if
se_cmd->data_length is a multiple of 8. Pass in a length of, say, 9 and
we will happily overwrite 7 bytes of "unallocated" memory.
Now, afaics this bug is currently harmless, as allocations will
implicitly be padded to multiples of 8 bytes. But depending on such a
fact wouldn't qualify as sound engineering practice.
Signed-off-by: Joern Engel <joern@logfs.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target/tcm_fc')
0 files changed, 0 insertions, 0 deletions