diff options
| author | Sagi Grimberg <sagig@mellanox.com> | 2015-07-15 10:55:37 +0300 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2015-07-23 22:53:05 -0700 |
| commit | f5a8b3a796db01b639435515b3adc003b9f27387 (patch) | |
| tree | 3ff4e026ec2af94cbef2cef9d365a5faf141059c /include/scsi/scsi_common.h | |
| parent | 12306b425d0dbab7b60f54e02d67cf3dfae494d1 (diff) | |
| download | lwn-f5a8b3a796db01b639435515b3adc003b9f27387.tar.gz lwn-f5a8b3a796db01b639435515b3adc003b9f27387.zip | |
scsi: Protect against buffer possible overflow in scsi_set_sense_information
Make sure that the input sense buffer has sufficient length
to fit the information descriptor (12 additional bytes).
Modify scsi_set_sense_information to receive the sense buffer
length and adjust its callers scsi target and libata.
(Fix patch fuzz in scsi_set_sense_information - nab)
Reported-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Tejun Heo <tj@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'include/scsi/scsi_common.h')
| -rw-r--r-- | include/scsi/scsi_common.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h index 156d673db900..11571b2a831e 100644 --- a/include/scsi/scsi_common.h +++ b/include/scsi/scsi_common.h @@ -62,7 +62,7 @@ extern bool scsi_normalize_sense(const u8 *sense_buffer, int sb_len, struct scsi_sense_hdr *sshdr); extern void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq); -extern void scsi_set_sense_information(u8 *buf, u64 info); +int scsi_set_sense_information(u8 *buf, int buf_len, u64 info); extern const u8 * scsi_sense_desc_find(const u8 * sense_buffer, int sb_len, int desc_type); |