target: Fix missing length check in spc_emulate_evpd_83()
Subsystems (2)
PATCH 1/1 target: Fix missing length check in spc_emulate_evpd_83()
From: Roland Dreier <[email protected]>
Commit fbfe858fea2a ("target_core_spc: Include target device descriptor in VPD page 83") added a new length variable, but (due to a cut and paste mistake?) just checks scsi_name_len against 256 twice. Fix this to check scsi_target_len for overflow too.
Signed-off-by Roland Dreier <[email protected]>
--- drivers/target/target_core_spc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/target/target_core_spc.c +2 -2
@@ -440,8 +440,8 @@ check_scsi_name: padding = ((-scsi_target_len) &3 );if (padding) scsi_target_len += padding; -if (scsi_name_len >256 ) - scsi_name_len =256 ; +if (scsi_target_len >256 ) + scsi_target_len =256 ; buf[off-1 ] = scsi_target_len; off += scsi_target_len;
Signature · 1 line
1.9.rc1
Nicholas A. Bellinger
AppliedQuoted 9 lines · Roland Dreier
From: Roland Dreier <[email protected]>
Commit
fbfe858fea2a("target_core_spc: Include target device descriptor in VPD page 83") added a new length variable, but (due to a cut and paste mistake?) just checksscsi_name_lenagainst 256 twice. Fix this to checkscsi_target_lenfor overflow too.Signed-off-by Roland Dreier <[email protected]>---
Applied.
Thanks Roland!
--nab
Quoted 18 lines
drivers/target/target_core_spc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)drivers/target/target_core_spc.c +2
-2@@ -440,8 +440,8 @@ check_scsi_name: padding = ((-scsi_target_len) &3 );if (padding) scsi_target_len += padding; -if (scsi_name_len >256 ) - scsi_name_len =256 ; +if (scsi_target_len >256 ) + scsi_target_len =256 ; buf[off-1 ] = scsi_target_len; off += scsi_target_len;