From: Mike Christie <michaelc@cs.wisc.edu>
Date: Fri, 27 Jan 2012 03:13:10 +0000 (-0600)
Subject: [SCSI] libiscsi_tcp: fix max_r2t manipulation
X-Git-Tag: v3.4-rc1~145^2~134
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1304be5fe0efb42b7ec6a50dd8e1a9bce2adae17;p=pandora-kernel.git

[SCSI] libiscsi_tcp: fix max_r2t manipulation

Problem description from Xi Wang:
A large max_r2t could lead to integer overflow in subsequent call to
iscsi_tcp_r2tpool_alloc(), allocating a smaller buffer than expected
and leading to out-of-bounds write.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
---

Reading git-diff-tree failed