From: Sebastian Ott <sebott@linux.vnet.ibm.com>
Date: Mon, 19 Jul 2010 07:22:37 +0000 (+0200)
Subject: [S390] cio: fix potential overflow in chpid descriptor
X-Git-Tag: v2.6.35-rc6~30^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=878c495644be28cc881e7ee792f00fd879a1ebf9;p=pandora-kernel.git

[S390] cio: fix potential overflow in chpid descriptor

The length filed in the chsc response block (if valid)
has a value of n*(sizeof(chp_desc))+8 (for the response
block header). When we memcopied from the response block
to the actual descriptor we copied 8 bytes too much.
The bug was not revealed since the descriptor is embedded
in struct channel_path.
Since we only write one descriptor at a time ignore the
length value and use sizeof(*desc).

Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
---

Reading git-diff-tree failed