lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[SCSI] libfc: fix symbolic name registrations smashing skb data

Browse Source 
The strncpy for RSPN_ID and RSNN_NN requests was padding
past the allocated frame size.

Get the string length before filling in the ct header.

Signed-off-by: Joe Eykholt <jeykholt@cisco.com>
Signed-off-by: Robert Love <robert.w.love@intel.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
This commit is contained in:
Joe Eykholt
2009-11-03 11:48:55 -08:00
committed by James Bottomley
parent 6049d95a8a
commit 5f9a056db9
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
include/scsi/fc_encode.h
View File

@@ -111,6 +111,7 @@ static inline int fc_ct_fill(struct fc_lport *lport,
enum fc_fh_type *fh_type) enum fc_fh_type *fh_type)
{ {
struct fc_ct_req *ct; struct fc_ct_req *ct;
size_t len;
switch (op) { switch (op) {
case FC_NS_GPN_FT: case FC_NS_GPN_FT:
@@ -138,22 +139,22 @@ static inline int fc_ct_fill(struct fc_lport *lport,
break; break;
case FC_NS_RSPN_ID: case FC_NS_RSPN_ID:
ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rspn)); len = strnlen(fc_host_symbolic_name(lport->host), 255);
ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rspn) + len);
hton24(ct->payload.spn.fr_fid.fp_fid, hton24(ct->payload.spn.fr_fid.fp_fid,
fc_host_port_id(lport->host)); fc_host_port_id(lport->host));
strncpy(ct->payload.spn.fr_name, strncpy(ct->payload.spn.fr_name,
fc_host_symbolic_name(lport->host), 255); fc_host_symbolic_name(lport->host), len);
ct->payload.spn.fr_name_len = ct->payload.spn.fr_name_len = len;
strnlen(ct->payload.spn.fr_name, 255);
break; break;
case FC_NS_RSNN_NN: case FC_NS_RSNN_NN:
ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rsnn)); len = strnlen(fc_host_symbolic_name(lport->host), 255);
ct = fc_ct_hdr_fill(fp, op, sizeof(struct fc_ns_rsnn) + len);
put_unaligned_be64(lport->wwnn, &ct->payload.snn.fr_wwn); put_unaligned_be64(lport->wwnn, &ct->payload.snn.fr_wwn);
strncpy(ct->payload.snn.fr_name, strncpy(ct->payload.snn.fr_name,
fc_host_symbolic_name(lport->host), 255); fc_host_symbolic_name(lport->host), len);
ct->payload.snn.fr_name_len = ct->payload.snn.fr_name_len = len;
strnlen(ct->payload.snn.fr_name, 255);
break; break;
default: default: