diff options
author | Dan Williams <dan.j.williams@intel.com> | 2011-06-16 20:20:35 -0400 |
---|---|---|
committer | Dan Williams <dan.j.williams@intel.com> | 2011-07-03 07:04:51 -0400 |
commit | 5edc33480c1c363ab361a881f2957b9fba5185cf (patch) | |
tree | 6725ee62eb2a2c48a2855701e1e8c5bc17d26715 /drivers/scsi | |
parent | ff60639dc9a461883db9192d2da0674a00339f12 (diff) |
isci: fix smp response frame overrun
Due to a typo we currently copy way too much when copying over the
response data, but since a request is likely backed by a full page
allocation we don't corrupt live data.
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r-- | drivers/scsi/isci/request.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c index ebe160c83f91..f4fbca7b1fa3 100644 --- a/drivers/scsi/isci/request.c +++ b/drivers/scsi/isci/request.c | |||
@@ -1694,7 +1694,7 @@ scic_sds_io_request_frame_handler(struct scic_sds_request *sci_req, | |||
1694 | frame_index, | 1694 | frame_index, |
1695 | &smp_resp); | 1695 | &smp_resp); |
1696 | 1696 | ||
1697 | word_cnt = (sizeof(struct smp_req) - SMP_RESP_HDR_SZ) / | 1697 | word_cnt = (sizeof(struct smp_resp) - SMP_RESP_HDR_SZ) / |
1698 | sizeof(u32); | 1698 | sizeof(u32); |
1699 | 1699 | ||
1700 | sci_swab32_cpy(((u8 *) rsp_hdr) + SMP_RESP_HDR_SZ, | 1700 | sci_swab32_cpy(((u8 *) rsp_hdr) + SMP_RESP_HDR_SZ, |