aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi
diff options
context:
space:
mode:
authorAnton Blanchard <anton@samba.org>2007-03-21 09:41:47 -0400
committerJames Bottomley <jejb@mulgrave.il.steeleye.com>2007-04-01 11:02:00 -0400
commit07da60c1f45a6a5f563429e88e8c94c82f9132eb (patch)
treec8a8e60f43a88af3e844093cf007935f4651c197 /drivers/scsi
parent802ae2f05b646c1e5f9e33cfe4c80cfa1452a0e3 (diff)
[SCSI] lpfc: fix oops when parsing dodgy VPD
We have seen two cases where VPD on an emulex card has been incorrect and we end up walking off the end of memory. It looks like someone made an update (increased the length of a string) without increasing the Length field. Then we do: Length -= (3+i); And since Length is unsigned it becomes very large and we loop forever in the encapsulating: while (Length > 0) { If we make Length signed then we fall out of the loop and proceed on. Its important to note we have only seen this in the lab and it may be the only two cases of this in existence, but since the rest of the code has been written to be resilient against bad VPD we may as well fix this too. Signed-off-by: Anton Blanchard <anton@samba.org> Acked-by: James Smart <James.Smart@Emulex.Com> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r--drivers/scsi/lpfc/lpfc_init.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 9d014e5a81c4..09a9c8ab2eae 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -671,7 +671,7 @@ static int
671lpfc_parse_vpd(struct lpfc_hba * phba, uint8_t * vpd, int len) 671lpfc_parse_vpd(struct lpfc_hba * phba, uint8_t * vpd, int len)
672{ 672{
673 uint8_t lenlo, lenhi; 673 uint8_t lenlo, lenhi;
674 uint32_t Length; 674 int Length;
675 int i, j; 675 int i, j;
676 int finished = 0; 676 int finished = 0;
677 int index = 0; 677 int index = 0;