From: Roland Dreier Date: Thu, 29 May 2014 20:32:30 +0000 (-0700) Subject: iscsi-target: Fix wrong buffer / buffer overrun in iscsi_change_param_value() X-Git-Tag: omap-for-v3.16/fixes-against-rc1~95^2~3 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=79d59d08082dd0a0a18f8ceb78c99f9f321d72aa;p=pandora-kernel.git iscsi-target: Fix wrong buffer / buffer overrun in iscsi_change_param_value() In non-leading connection login, iscsi_login_non_zero_tsih_s1() calls iscsi_change_param_value() with the buffer it uses to hold the login PDU, not a temporary buffer. This leads to the login header getting corrupted and login failing for non-leading connections in MC/S. Fix this by adding a wrapper iscsi_change_param_sprintf() that handles the temporary buffer itself to avoid confusion. Also handle sending a reject in case of failure in the wrapper, which lets the calling code get quite a bit smaller and easier to read. Finally, bump the size of the temporary buffer from 32 to 64 bytes to be safe, since "MaxRecvDataSegmentLength=" by itself is 25 bytes; with a trailing NUL, a value >= 1M will lead to a buffer overrun. (This isn't the default but we don't need to run right at the ragged edge here) Reported-by: Santosh Kulkarni Signed-off-by: Roland Dreier Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Nicholas Bellinger --- Reading git-diff-tree failed