Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2dc127bb authored by Dan Carpenter's avatar Dan Carpenter Committed by James Bottomley
Browse files

hpsa: fix an sprintf() overflow in the reset handler 



The string "cmd %d RESET FAILED, new lockup detected" is not quite
large enough so the sprintf() will overflow.  I have increased the size
of the buffer and also changed the sprintf calls to snprintf.

Fixes: 73153fe5 ('hpsa: use block layer tag for command allocation')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarDon Brace <don.brace@pmcs.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
parent 9c8108a4

drivers/scsi/hpsa.c

+9 −6
Original line number Diff line number Diff line
@@ -5104,7 +5104,7 @@ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd) 
	int rc;

	struct ctlr_info *h;

	struct hpsa_scsi_dev_t *dev;

	char msg[40];

	char msg[48];



	/* find the controller to which the command to be aborted was sent */

	h = sdev_to_hba(scsicmd->device);
@@ -5122,7 +5122,8 @@ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd) 


	/* if controller locked up, we can guarantee command won't complete */

	if (lockup_detected(h)) {

		sprintf(msg, "cmd %d RESET FAILED, lockup detected",

		snprintf(msg, sizeof(msg),

			 "cmd %d RESET FAILED, lockup detected",

			 hpsa_get_cmd_index(scsicmd));

		hpsa_show_dev_msg(KERN_WARNING, h, dev, msg);

		return FAILED;
@@ -5130,7 +5131,8 @@ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd) 


	/* this reset request might be the result of a lockup; check */

	if (detect_controller_lockup(h)) {

		sprintf(msg, "cmd %d RESET FAILED, new lockup detected",

		snprintf(msg, sizeof(msg),

			 "cmd %d RESET FAILED, new lockup detected",

			 hpsa_get_cmd_index(scsicmd));

		hpsa_show_dev_msg(KERN_WARNING, h, dev, msg);

		return FAILED;
@@ -5145,7 +5147,8 @@ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd) 
	/* send a reset to the SCSI LUN which the command was sent to */

	rc = hpsa_do_reset(h, dev, dev->scsi3addr, HPSA_RESET_TYPE_LUN,

			   DEFAULT_REPLY_QUEUE);

	sprintf(msg, "reset %s", rc == 0 ? "completed successfully" : "failed");

	snprintf(msg, sizeof(msg), "reset %s",

		 rc == 0 ? "completed successfully" : "failed");

	hpsa_show_dev_msg(KERN_WARNING, h, dev, msg);

	return rc == 0 ? SUCCESS : FAILED;

}