diff options
| author | Sebastian Ott <sebott@linux.vnet.ibm.com> | 2010-07-19 09:22:37 +0200 |
|---|---|---|
| committer | Martin Schwidefsky <sky@mschwide.boeblingen.de.ibm.com> | 2010-07-19 09:22:50 +0200 |
| commit | 878c495644be28cc881e7ee792f00fd879a1ebf9 (patch) | |
| tree | 61f9ea2be8e821424d2643c8a26b720fd2a5a3bf /net/rds/iw_rdma.c | |
| parent | 0abccf77402af44855da739b439d01cfb65b4bfd (diff) | |
[S390] cio: fix potential overflow in chpid descriptor
The length filed in the chsc response block (if valid)
has a value of n*(sizeof(chp_desc))+8 (for the response
block header). When we memcopied from the response block
to the actual descriptor we copied 8 bytes too much.
The bug was not revealed since the descriptor is embedded
in struct channel_path.
Since we only write one descriptor at a time ignore the
length value and use sizeof(*desc).
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Diffstat (limited to 'net/rds/iw_rdma.c')
0 files changed, 0 insertions, 0 deletions