Commit 16b93277 authored by Dan Carpenter's avatar Dan Carpenter Committed by Nicholas Bellinger

tcmu: Fix some memory corruption

"udev->nl_reply_supported" is an int but on 64 bit arches we are writing
8 bytes of data to it so it corrupts four bytes beyond the end of the
struct.

Fixes: b849b456 ("target: Add netlink command reply supported option for each device")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 3fc9fb13
...@@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev, ...@@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
ret = -ENOMEM; ret = -ENOMEM;
break; break;
} }
ret = kstrtol(arg_p, 0, ret = kstrtoint(arg_p, 0, &udev->nl_reply_supported);
(long int *) &udev->nl_reply_supported);
kfree(arg_p); kfree(arg_p);
if (ret < 0) if (ret < 0)
pr_err("kstrtoul() failed for nl_reply_supported=\n"); pr_err("kstrtoint() failed for nl_reply_supported=\n");
break; break;
default: default:
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment