Commit 6a16d7be authored by Roland Dreier's avatar Roland Dreier Committed by Nicholas Bellinger

target: Fix missing length check in spc_emulate_evpd_83()

Commit fbfe858f ("target_core_spc: Include target device
descriptor in VPD page 83") added a new length variable, but (due to a
cut and paste mistake?) just checks scsi_name_len against 256 twice.
Fix this to check scsi_target_len for overflow too.
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 2d15025a
...@@ -440,8 +440,8 @@ spc_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf) ...@@ -440,8 +440,8 @@ spc_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
padding = ((-scsi_target_len) & 3); padding = ((-scsi_target_len) & 3);
if (padding) if (padding)
scsi_target_len += padding; scsi_target_len += padding;
if (scsi_name_len > 256) if (scsi_target_len > 256)
scsi_name_len = 256; scsi_target_len = 256;
buf[off-1] = scsi_target_len; buf[off-1] = scsi_target_len;
off += scsi_target_len; off += scsi_target_len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment