提交 6599eaaa 编写于 作者: A Ales Novak 提交者: James Bottomley

fix: lpfc_send_rscn_event sends bigger buffer size

lpfc_send_rscn_event() allocates data for sizeof(struct
lpfc_rscn_event_header) + payload_len, but claims that the data has size
of sizeof(struct lpfc_els_event_header) + payload_len. That leads to
buffer overruns.
Signed-off-by: NAles Novak <alnovak@suse.cz>
Signed-off-by: NJames Smart <james.smart@avagotech.com>
Reviewed-by: NHannes Reinecke <hare@suse.de>
Reviewed-by: NSebastian Herbszt <herbszt@gmx.de>
Signed-off-by: NJames Bottomley <JBottomley@Odin.com>
上级 db6f1c2f
...@@ -5401,7 +5401,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport, ...@@ -5401,7 +5401,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport,
fc_host_post_vendor_event(shost, fc_host_post_vendor_event(shost,
fc_get_event_number(), fc_get_event_number(),
sizeof(struct lpfc_els_event_header) + payload_len, sizeof(struct lpfc_rscn_event_header) + payload_len,
(char *)rscn_event_data, (char *)rscn_event_data,
LPFC_NL_VENDOR_ID); LPFC_NL_VENDOR_ID);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册