From: Nicholas Bellinger Date: Wed, 19 Oct 2011 06:48:04 +0000 (-0700) Subject: target: Fix REPORT TARGET PORT GROUPS handling with small allocation length X-Git-Tag: v3.2-rc1~24^2~43 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6b20fa9aaf0c2f69ee6f9648e20ab2be0206705e;p=pandora-kernel.git target: Fix REPORT TARGET PORT GROUPS handling with small allocation length This patch fixes a bug with the handling of REPORT TARGET PORT GROUPS containing a smaller allocation length than the payload requires causing memory writes beyond the end of the buffer. This patch checks for the minimum 4 byte length for the response payload length, and also checks upon each loop of T10_ALUA(su_dev)->tg_pt_gps_list to ensure the Target port group and Target port descriptor list is able to fit into the remaining allocation length. If the response payload exceeds the allocation length length, then rd_len is still increments to indicate to the initiator that the payload has been truncated. Reported-by: Roland Dreier Cc: stable@kernel.org Signed-off-by: Nicholas Bellinger --- Reading git-diff-tree failed