From 6599eaaa45e0f40ddbbcf164cf3e3524faed9383 Mon Sep 17 00:00:00 2001 From: Ales Novak Date: Mon, 31 Aug 2015 16:48:16 -0400 Subject: fix: lpfc_send_rscn_event sends bigger buffer size lpfc_send_rscn_event() allocates data for sizeof(struct lpfc_rscn_event_header) + payload_len, but claims that the data has size of sizeof(struct lpfc_els_event_header) + payload_len. That leads to buffer overruns. Signed-off-by: Ales Novak Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Reviewed-by: Sebastian Herbszt Signed-off-by: James Bottomley --- drivers/scsi/lpfc/lpfc_els.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/scsi/lpfc') diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index c859aa3c0f9a..f9c957d64c02 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -5401,7 +5401,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport, fc_host_post_vendor_event(shost, fc_get_event_number(), - sizeof(struct lpfc_els_event_header) + payload_len, + sizeof(struct lpfc_rscn_event_header) + payload_len, (char *)rscn_event_data, LPFC_NL_VENDOR_ID); -- cgit v1.2.3