Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-11 00:08:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tcmu: Fix some memory corruption

Browse Source 
"udev->nl_reply_supported" is an int but on 64 bit arches we are writing
8 bytes of data to it so it corrupts four bytes beyond the end of the
struct.

Fixes: b849b4567549 ("target: Add netlink command reply supported option for each device")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
Dan Carpenter 2017-11-08 11:43:44 +03:00 committed by Nicholas Bellinger
parent 3fc9fb13a4
commit 16b9327704
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/target/target_core_user.c
View File

@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
ret = -ENOMEM;
break;
}
ret = kstrtol(arg_p, 0,
(long int *) &udev->nl_reply_supported);
ret = kstrtoint(arg_p, 0, &udev->nl_reply_supported);
kfree(arg_p);
if (ret < 0)
pr_err("kstrtoul() failed for nl_reply_supported=\n");
pr_err("kstrtoint() failed for nl_reply_supported=\n");
break;
default:
break;