summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorAles Novak <alnovak@suse.cz>2015-08-31 16:48:16 -0400
committerJames Bottomley <JBottomley@Odin.com>2015-10-27 10:08:51 +0900
commit6599eaaa45e0f40ddbbcf164cf3e3524faed9383 (patch)
tree1219d04b1e8030cd44ebac3aa6de9b7e6505e59a /drivers
parentdb6f1c2f900b536d23de386dc7f2a53aa80d7307 (diff)
fix: lpfc_send_rscn_event sends bigger buffer size
lpfc_send_rscn_event() allocates data for sizeof(struct lpfc_rscn_event_header) + payload_len, but claims that the data has size of sizeof(struct lpfc_els_event_header) + payload_len. That leads to buffer overruns. Signed-off-by: Ales Novak <alnovak@suse.cz> Signed-off-by: James Smart <james.smart@avagotech.com> Reviewed-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Sebastian Herbszt <herbszt@gmx.de> Signed-off-by: James Bottomley <JBottomley@Odin.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/scsi/lpfc/lpfc_els.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index c859aa3c0f9a..f9c957d64c02 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -5401,7 +5401,7 @@ lpfc_send_rscn_event(struct lpfc_vport *vport,
fc_host_post_vendor_event(shost,
fc_get_event_number(),
- sizeof(struct lpfc_els_event_header) + payload_len,
+ sizeof(struct lpfc_rscn_event_header) + payload_len,
(char *)rscn_event_data,
LPFC_NL_VENDOR_ID);