Re: bug report: sd: off by one in sd_read_block_limits()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



>>>>> "Dan" == Dan Carpenter <error27@xxxxxxxxx> writes:

Dan> drivers/scsi/sd.c +1986 sd_read_block_limits(39) warn: buffer
Dan> overflow 'buffer' 32 <= 32
Dan>   1951 const int vpd_len = 32;

sd: Fix block limits VPD page length

Commit e3deec09 incorrectly assumed that the page length was limited to
32 bytes.  The B0 VPD page length is defined to be 60 bytes when the
device supports thin provisioning.

Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>

---

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 1dd4d84..3ed2644 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1948,7 +1948,7 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
 {
 	struct request_queue *q = sdkp->disk->queue;
 	unsigned int sector_sz = sdkp->device->sector_size;
-	const int vpd_len = 32;
+	const int vpd_len = 60;
 	unsigned char *buffer = kmalloc(vpd_len, GFP_KERNEL);
 
 	if (!buffer ||
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux