summaryrefslogtreecommitdiff
path: root/drivers/scsi/ses.c
diff options
context:
space:
mode:
authorJames Bottomley <James.Bottomley@HansenPartnership.com>2008-07-29 20:38:25 +0400
committerJames Bottomley <James.Bottomley@HansenPartnership.com>2008-07-30 19:21:56 +0400
commit671a99c8eb2f1dde08ac5538d8cd912047c61ddf (patch)
treeb02cba45dbe7a69a7c9c24aa815bd3e82fde7725 /drivers/scsi/ses.c
parentad337591f4fd20de6a0ca03d6715267a5c1d2b16 (diff)
downloadlinux-671a99c8eb2f1dde08ac5538d8cd912047c61ddf.tar.xz
[SCSI] ses: fix VPD inquiry overrun
There are a few kerneloops.org reports like this one: http://www.kerneloops.org/search.php?search=ses_match_to_enclosure That seem to imply we're running off the end of the VPD inquiry data (although at 512 bytes, it should be long enough for just about anything). we should be using correctly sized buffers anyway, so put those in and hope this oops goes away. Cc: Stable Tree <stable@kernel.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'drivers/scsi/ses.c')
-rw-r--r--drivers/scsi/ses.c18
1 files changed, 14 insertions, 4 deletions
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 0fe031f003e7..1bcf3c33d7ff 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -345,14 +345,14 @@ static int ses_enclosure_find_by_addr(struct enclosure_device *edev,
return 0;
}
-#define VPD_INQUIRY_SIZE 512
+#define VPD_INQUIRY_SIZE 36
static void ses_match_to_enclosure(struct enclosure_device *edev,
struct scsi_device *sdev)
{
unsigned char *buf = kmalloc(VPD_INQUIRY_SIZE, GFP_KERNEL);
unsigned char *desc;
- int len;
+ u16 vpd_len;
struct efd efd = {
.addr = 0,
};
@@ -372,9 +372,19 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
VPD_INQUIRY_SIZE, NULL, SES_TIMEOUT, SES_RETRIES))
goto free;
- len = (buf[2] << 8) + buf[3];
+ vpd_len = (buf[2] << 8) + buf[3];
+ kfree(buf);
+ buf = kmalloc(vpd_len, GFP_KERNEL);
+ if (!buf)
+ return;
+ cmd[3] = vpd_len >> 8;
+ cmd[4] = vpd_len & 0xff;
+ if (scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf,
+ vpd_len, NULL, SES_TIMEOUT, SES_RETRIES))
+ goto free;
+
desc = buf + 4;
- while (desc < buf + len) {
+ while (desc < buf + vpd_len) {
enum scsi_protocol proto = desc[0] >> 4;
u8 code_set = desc[0] & 0x0f;
u8 piv = desc[1] & 0x80;