diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-11-08 11:43:44 +0300 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2017-11-08 01:42:31 -0800 |
| commit | 16b932770417b1bc304d87c48aa0bb8a3c1164e1 (patch) | |
| tree | d0eab8160e08ca275483b1b6a4844bbacbeff901 | |
| parent | 3fc9fb13a4b2576aeab86c62fd64eb29ab68659c (diff) | |
| download | linux-16b932770417b1bc304d87c48aa0bb8a3c1164e1.tar.bz2 | |
tcmu: Fix some memory corruption
"udev->nl_reply_supported" is an int but on 64 bit arches we are writing
8 bytes of data to it so it corrupts four bytes beyond the end of the
struct.
Fixes: b849b4567549 ("target: Add netlink command reply supported option for each device")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
| -rw-r--r-- | drivers/target/target_core_user.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c index 9ddf0909d33e..d2b8d5ccb446 100644 --- a/drivers/target/target_core_user.c +++ b/drivers/target/target_core_user.c @@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev, ret = -ENOMEM; break; } - ret = kstrtol(arg_p, 0, - (long int *) &udev->nl_reply_supported); + ret = kstrtoint(arg_p, 0, &udev->nl_reply_supported); kfree(arg_p); if (ret < 0) - pr_err("kstrtoul() failed for nl_reply_supported=\n"); + pr_err("kstrtoint() failed for nl_reply_supported=\n"); break; default: break; |