diff options
author | Roland Dreier <roland@purestorage.com> | 2014-02-03 03:35:03 -0500 |
---|---|---|
committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2014-02-12 18:11:04 -0500 |
commit | 6a16d7be932a9df1024836ccbb448de73afd3dd0 (patch) | |
tree | 14a6fdc34f180fc8311d1000b16f10aff10001e6 | |
parent | 2d15025a568ba8ab2bc6120fb13c62a9ca322f62 (diff) |
target: Fix missing length check in spc_emulate_evpd_83()
Commit fbfe858fea2a ("target_core_spc: Include target device
descriptor in VPD page 83") added a new length variable, but (due to a
cut and paste mistake?) just checks scsi_name_len against 256 twice.
Fix this to check scsi_target_len for overflow too.
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
-rw-r--r-- | drivers/target/target_core_spc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c index 43c5ca9878bc..3bebc71ea033 100644 --- a/drivers/target/target_core_spc.c +++ b/drivers/target/target_core_spc.c | |||
@@ -440,8 +440,8 @@ check_scsi_name: | |||
440 | padding = ((-scsi_target_len) & 3); | 440 | padding = ((-scsi_target_len) & 3); |
441 | if (padding) | 441 | if (padding) |
442 | scsi_target_len += padding; | 442 | scsi_target_len += padding; |
443 | if (scsi_name_len > 256) | 443 | if (scsi_target_len > 256) |
444 | scsi_name_len = 256; | 444 | scsi_target_len = 256; |
445 | 445 | ||
446 | buf[off-1] = scsi_target_len; | 446 | buf[off-1] = scsi_target_len; |
447 | off += scsi_target_len; | 447 | off += scsi_target_len; |