diff options
| author | nagalakshmi.nandigama@lsi.com <nagalakshmi.nandigama@lsi.com> | 2012-03-20 12:10:01 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-06-01 15:12:54 +0800 |
| commit | 35d73fe5e3d8c72a41c2eaf285a9bfb7b6c66aee (patch) | |
| tree | d838a088ed0e6ef05cb69db689f773e165a600e9 /drivers/infiniband | |
| parent | a35021b41669bd9d067e87c27115fb18de2a6834 (diff) | |
| download | kernel_samsung_aries-35d73fe5e3d8c72a41c2eaf285a9bfb7b6c66aee.zip kernel_samsung_aries-35d73fe5e3d8c72a41c2eaf285a9bfb7b6c66aee.tar.gz kernel_samsung_aries-35d73fe5e3d8c72a41c2eaf285a9bfb7b6c66aee.tar.bz2 | |
SCSI: mpt2sas: Fix for panic happening because of improper memory allocation
commit e42fafc25fa86c61824e8d4c5e7582316415d24f upstream.
The ioc->pfacts member in the IOC structure is getting set to zero
following a call to _base_get_ioc_facts due to the memset in that routine.
So if the ioc->pfacts was read after a host reset, there would be a NULL
pointer dereference. The routine _base_get_ioc_facts is called from context
of host reset. The problem in _base_get_ioc_facts is the size of
Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60,
so there is a four byte overflow resulting from the memset.
Also, there is memset in _base_get_port_facts using the incorrect structure,
it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply.
Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/infiniband')
0 files changed, 0 insertions, 0 deletions