forked from luck/tmp_suning_uos_patched
target: Fix missing length check in spc_emulate_evpd_83()
Commit fbfe858fea
("target_core_spc: Include target device
descriptor in VPD page 83") added a new length variable, but (due to a
cut and paste mistake?) just checks scsi_name_len against 256 twice.
Fix this to check scsi_target_len for overflow too.
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
parent
2d15025a56
commit
6a16d7be93
|
@ -440,8 +440,8 @@ spc_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
|
|||
padding = ((-scsi_target_len) & 3);
|
||||
if (padding)
|
||||
scsi_target_len += padding;
|
||||
if (scsi_name_len > 256)
|
||||
scsi_name_len = 256;
|
||||
if (scsi_target_len > 256)
|
||||
scsi_target_len = 256;
|
||||
|
||||
buf[off-1] = scsi_target_len;
|
||||
off += scsi_target_len;
|
||||
|
|
Loading…
Reference in New Issue
Block a user