mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-26 02:39:48 +00:00
Code Issues Releases Wiki Activity

[SCSI] qla4xxx: Fix memory corruption issue in qla4xxx_ep_connect.

Browse source 
In qla4xxx_ep_connect(), qla_ep->dst_addr and dst_addr are type
struct sockaddr. We are copying sizeof(struct sockaddr_in6) bytes
from dst_addr to qla_ep->dst_addr which is 12 bytes larger. This
will cause memory corruption. So we change qla_ep->dst_addr to
struct sockaddr_storage which is of 128 byte, large enough to
hold sizeof(struct sockaddr_in6).

Signed-off-by: Manish Rangankar <manish.rangankar@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This commit is contained in:
Manish Rangankar 2012-08-07 07:57:13 -04:00 committed by James Bottomley
parent 95ab000388
commit d46bdeb144
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/scsi/qla4xxx/ql4_def.h
View file

@ -752,7 +752,7 @@ struct ql4_task_data {
struct qla_endpoint {
struct Scsi_Host *host;
struct sockaddr dst_addr;
struct sockaddr_storage dst_addr;
};
struct qla_conn {

2
drivers/scsi/qla4xxx/ql4_mbx.c
View file

@ -1695,7 +1695,7 @@ int qla4xxx_set_param_ddbentry(struct scsi_qla_host *ha,
conn = cls_conn->dd_data;
qla_conn = conn->dd_data;
sess = conn->session;
dst_addr = &qla_conn->qla_ep->dst_addr;
dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
if (dst_addr->sa_family == AF_INET6)
options |= IPV6_DEFAULT_DDB_ENTRY;

2
drivers/scsi/qla4xxx/ql4_os.c
View file

@ -1366,7 +1366,7 @@ static int qla4xxx_conn_get_param(struct iscsi_cls_conn *cls_conn,
conn = cls_conn->dd_data;
qla_conn = conn->dd_data;
dst_addr = &qla_conn->qla_ep->dst_addr;
dst_addr = (struct sockaddr *)&qla_conn->qla_ep->dst_addr;
switch (param) {
case ISCSI_PARAM_CONN_PORT: