e42fafc25f
The ioc->pfacts member in the IOC structure is getting set to zero following a call to _base_get_ioc_facts due to the memset in that routine. So if the ioc->pfacts was read after a host reset, there would be a NULL pointer dereference. The routine _base_get_ioc_facts is called from context of host reset. The problem in _base_get_ioc_facts is the size of Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60, so there is a four byte overflow resulting from the memset. Also, there is memset in _base_get_port_facts using the incorrect structure, it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply. Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com> CC: stable@vger.kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com> |
||
|---|---|---|
| .. | ||
| mpi | ||
| Kconfig | ||
| Makefile | ||
| mpt2sas_base.c | ||
| mpt2sas_base.h | ||
| mpt2sas_config.c | ||
| mpt2sas_ctl.c | ||
| mpt2sas_ctl.h | ||
| mpt2sas_debug.h | ||
| mpt2sas_scsih.c | ||
| mpt2sas_transport.c | ||