Commit 073fe981 authored by Russell King's avatar Russell King

[ARM] Fix buffer overflow in fas216-based SCSI drivers.

100 characters is too small for the SCSI "info" string buffer; the
last few characters appear to get stomped on.  Make the buffer 150
characters long.
parent 34b135e3
...@@ -262,7 +262,7 @@ static void arxescsi_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp) ...@@ -262,7 +262,7 @@ static void arxescsi_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp)
const char *arxescsi_info(struct Scsi_Host *host) const char *arxescsi_info(struct Scsi_Host *host)
{ {
struct arxescsi_info *info = (struct arxescsi_info *)host->hostdata; struct arxescsi_info *info = (struct arxescsi_info *)host->hostdata;
static char string[100], *p; static char string[150], *p;
p = string; p = string;
p += sprintf(p, "%s ", host->hostt->name); p += sprintf(p, "%s ", host->hostt->name);
......
...@@ -304,7 +304,7 @@ cumanascsi_2_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp) ...@@ -304,7 +304,7 @@ cumanascsi_2_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp)
const char *cumanascsi_2_info(struct Scsi_Host *host) const char *cumanascsi_2_info(struct Scsi_Host *host)
{ {
struct cumanascsi2_info *info = (struct cumanascsi2_info *)host->hostdata; struct cumanascsi2_info *info = (struct cumanascsi2_info *)host->hostdata;
static char string[100], *p; static char string[150], *p;
p = string; p = string;
p += sprintf(p, "%s ", host->hostt->name); p += sprintf(p, "%s ", host->hostt->name);
......
...@@ -307,7 +307,7 @@ eesoxscsi_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp) ...@@ -307,7 +307,7 @@ eesoxscsi_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp)
const char *eesoxscsi_info(struct Scsi_Host *host) const char *eesoxscsi_info(struct Scsi_Host *host)
{ {
struct eesoxscsi_info *info = (struct eesoxscsi_info *)host->hostdata; struct eesoxscsi_info *info = (struct eesoxscsi_info *)host->hostdata;
static char string[100], *p; static char string[150], *p;
p = string; p = string;
p += sprintf(p, "%s ", host->hostt->name); p += sprintf(p, "%s ", host->hostt->name);
......
...@@ -188,7 +188,7 @@ powertecscsi_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp) ...@@ -188,7 +188,7 @@ powertecscsi_dma_stop(struct Scsi_Host *host, Scsi_Pointer *SCp)
const char *powertecscsi_info(struct Scsi_Host *host) const char *powertecscsi_info(struct Scsi_Host *host)
{ {
struct powertec_info *info = (struct powertec_info *)host->hostdata; struct powertec_info *info = (struct powertec_info *)host->hostdata;
static char string[100], *p; static char string[150], *p;
p = string; p = string;
p += sprintf(p, "%s ", host->hostt->name); p += sprintf(p, "%s ", host->hostt->name);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment