Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c60cfd7 authored by Dan Carpenter's avatar Dan Carpenter Committed by James Bottomley
Browse files

[SCSI] qla4xxx: overflow in qla4xxx_set_chap_entry() 



We should cap the size of memcpy() because it comes from the network
and can't be trusted.

Fixes: 26ffd7b4 ('[SCSI] qla4xxx: Add support to set CHAP entries')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent 88397c27

drivers/scsi/qla4xxx/ql4_os.c

+7 −4
Original line number Diff line number Diff line
@@ -861,6 +861,7 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len) 
	int type;

	int rem = len;

	int rc = 0;

	int size;



	memset(&chap_rec, 0, sizeof(chap_rec));
@@ -875,12 +876,14 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len) 
			chap_rec.chap_type = param_info->value[0];

			break;

		case ISCSI_CHAP_PARAM_USERNAME:

			memcpy(chap_rec.username, param_info->value,

			size = min_t(size_t, sizeof(chap_rec.username),

				     param_info->len);

			memcpy(chap_rec.username, param_info->value, size);

			break;

		case ISCSI_CHAP_PARAM_PASSWORD:

			memcpy(chap_rec.password, param_info->value,

			size = min_t(size_t, sizeof(chap_rec.password),

				     param_info->len);

			memcpy(chap_rec.password, param_info->value, size);

			break;

		case ISCSI_CHAP_PARAM_PASSWORD_LEN:

			chap_rec.password_length = param_info->value[0];