From: Dan Carpenter Date: Wed, 9 Jun 2010 12:01:54 +0000 (+0200) Subject: sata_sil24: memset() overflow X-Git-Tag: v2.6.35-rc3~9 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=14e45c15e1dcc4d972b41343661683efd60fed72;p=pandora-kernel.git sata_sil24: memset() overflow cb->atapi.cdb is an array of 16 u8 elements. The call too memset() would set the first part of the sge array to zero as well. It's not a packed struct. This one has been around for five years. I found it with Smatch. I think the reason no one has seen it before is because we normally call sil24_fill_sg() and that overwrites sge with proper information? Signed-off-by: Dan Carpenter Signed-off-by: Jeff Garzik --- Reading git-diff-tree failed