summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2017-11-08 11:43:44 +0300
committerNicholas Bellinger <nab@linux-iscsi.org>2017-11-08 01:42:31 -0800
commit16b932770417b1bc304d87c48aa0bb8a3c1164e1 (patch)
treed0eab8160e08ca275483b1b6a4844bbacbeff901
parent3fc9fb13a4b2576aeab86c62fd64eb29ab68659c (diff)
downloadlinux-16b932770417b1bc304d87c48aa0bb8a3c1164e1.tar.bz2
tcmu: Fix some memory corruption
"udev->nl_reply_supported" is an int but on 64 bit arches we are writing 8 bytes of data to it so it corrupts four bytes beyond the end of the struct. Fixes: b849b4567549 ("target: Add netlink command reply supported option for each device") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
-rw-r--r--drivers/target/target_core_user.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 9ddf0909d33e..d2b8d5ccb446 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
ret = -ENOMEM;
break;
}
- ret = kstrtol(arg_p, 0,
- (long int *) &udev->nl_reply_supported);
+ ret = kstrtoint(arg_p, 0, &udev->nl_reply_supported);
kfree(arg_p);
if (ret < 0)
- pr_err("kstrtoul() failed for nl_reply_supported=\n");
+ pr_err("kstrtoint() failed for nl_reply_supported=\n");
break;
default:
break;