mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
[SCSI] qla4xxx: Fix memory corruption issue in qla4xxx_ep_connect.
In qla4xxx_ep_connect(), qla_ep->dst_addr and dst_addr are type struct sockaddr. We are copying sizeof(struct sockaddr_in6) bytes from dst_addr to qla_ep->dst_addr which is 12 bytes larger. This will cause memory corruption. So we change qla_ep->dst_addr to struct sockaddr_storage which is of 128 byte, large enough to hold sizeof(struct sockaddr_in6). Signed-off-by: Manish Rangankar <manish.rangankar@qlogic.com> Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com> Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This commit is contained in:
parent
95ab000388
commit
d46bdeb144
3 changed files with 3 additions and 3 deletions
|
@ -752,7 +752,7 @@ struct ql4_task_data {
|
|||
|
||||
struct qla_endpoint {
|
||||
struct Scsi_Host *host;
|
||||
struct sockaddr dst_addr;
|
||||
struct sockaddr_storage dst_addr;
|
||||
};
|
||||
|
||||
struct qla_conn {
|
||||
|
|
|
@ -1695,7 +1695,7 @@ int qla4xxx_set_param_ddbentry(struct scsi_qla_host *ha,
|
|||
conn = cls_conn->dd_data;
|
||||
qla_conn = conn->dd_data;
|
||||
sess = conn->session;
|
||||
dst_addr = &qla_conn->qla_ep->dst_addr;
|
||||
dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
|
||||
|
||||
if (dst_addr->sa_family == AF_INET6)
|
||||
options |= IPV6_DEFAULT_DDB_ENTRY;
|
||||
|
|
|
@ -1366,7 +1366,7 @@ static int qla4xxx_conn_get_param(struct iscsi_cls_conn *cls_conn,
|
|||
|
||||
conn = cls_conn->dd_data;
|
||||
qla_conn = conn->dd_data;
|
||||
dst_addr = &qla_conn->qla_ep->dst_addr;
|
||||
dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
|
||||
|
||||
switch (param) {
|
||||
case ISCSI_PARAM_CONN_PORT:
|
||||
|
|
Loading…
Reference in a new issue