p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

hpsa: fix an sprintf() overflow in the reset handler 

The string "cmd %d RESET FAILED, new lockup detected" is not quite
large enough so the sprintf() will overflow.  I have increased the size
of the buffer and also changed the sprintf calls to snprintf.

Fixes: 73153fe533 ('hpsa: use block layer tag for command allocation')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
This commit is contained in:
Dan Carpenter 2015-06-04 17:47:56 +03:00 committed by James Bottomley
parent 9c8108a4d3
commit 2dc127bb29
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/scsi/hpsa.c
View File

@ -5104,7 +5104,7 @@ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd)
int rc;
struct ctlr_info *h;
struct hpsa_scsi_dev_t *dev;
char msg[40];
char msg[48];
/* find the controller to which the command to be aborted was sent */
h = sdev_to_hba(scsicmd->device);
@ -5122,16 +5122,18 @@ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd)
/* if controller locked up, we can guarantee command won't complete */
if (lockup_detected(h)) {
sprintf(msg, "cmd %d RESET FAILED, lockup detected",
hpsa_get_cmd_index(scsicmd));
snprintf(msg, sizeof(msg),
"cmd %d RESET FAILED, lockup detected",
hpsa_get_cmd_index(scsicmd));
hpsa_show_dev_msg(KERN_WARNING, h, dev, msg);
return FAILED;
}
/* this reset request might be the result of a lockup; check */
if (detect_controller_lockup(h)) {
sprintf(msg, "cmd %d RESET FAILED, new lockup detected",
hpsa_get_cmd_index(scsicmd));
snprintf(msg, sizeof(msg),
"cmd %d RESET FAILED, new lockup detected",
hpsa_get_cmd_index(scsicmd));
hpsa_show_dev_msg(KERN_WARNING, h, dev, msg);
return FAILED;
}
@ -5145,7 +5147,8 @@ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd)
/* send a reset to the SCSI LUN which the command was sent to */
rc = hpsa_do_reset(h, dev, dev->scsi3addr, HPSA_RESET_TYPE_LUN,
DEFAULT_REPLY_QUEUE);
sprintf(msg, "reset %s", rc == 0 ? "completed successfully" : "failed");
snprintf(msg, sizeof(msg), "reset %s",
rc == 0 ? "completed successfully" : "failed");
hpsa_show_dev_msg(KERN_WARNING, h, dev, msg);
return rc == 0 ? SUCCESS : FAILED;
}