Commit 16b93277 authored Nov 08, 2017 by Dan Carpenter Committed by Nicholas Bellinger Nov 08, 2017

tcmu: Fix some memory corruption



"udev->nl_reply_supported" is an int but on 64 bit arches we are writing
8 bytes of data to it so it corrupts four bytes beyond the end of the
struct.

Fixes: b849b456 ("target: Add netlink command reply supported option for each device")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

parent 3fc9fb13

drivers/target/target_core_user.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
		ret = -ENOMEM;
		break;
		}
		ret = kstrtol(arg_p, 0,
		(long int *) &udev->nl_reply_supported);
		ret = kstrtoint(arg_p, 0, &udev->nl_reply_supported);
		kfree(arg_p);
		if (ret < 0)
		pr_err("kstrtoul() failed for nl_reply_supported=\n");
		pr_err("kstrtoint() failed for nl_reply_supported=\n");
		break;
		default:
		break;