Commit a01a5a57 authored by Yi Zou's avatar Yi Zou Committed by James Bottomley

[SCSI] libfcoe: fix possible buffer overflow in fcoe_transport_show

possible buffer overflow in fcoe_transport_show when reaching the end of
buffer and crossing PAGE_SIZE boundary.
Signed-off-by: default avatarYi Zou <yi.zou@intel.com>
Signed-off-by: default avatarTomas Henzl <thenzl@redhat.com>
Tested-by: default avatarRoss Brattain <ross.b.brattain@intel.com>
Signed-off-by: default avatarRobert Love <robert.w.love@intel.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 69922fcd
...@@ -385,9 +385,9 @@ static int fcoe_transport_show(char *buffer, const struct kernel_param *kp) ...@@ -385,9 +385,9 @@ static int fcoe_transport_show(char *buffer, const struct kernel_param *kp)
i = j = sprintf(buffer, "Attached FCoE transports:"); i = j = sprintf(buffer, "Attached FCoE transports:");
mutex_lock(&ft_mutex); mutex_lock(&ft_mutex);
list_for_each_entry(ft, &fcoe_transports, list) { list_for_each_entry(ft, &fcoe_transports, list) {
i += snprintf(&buffer[i], IFNAMSIZ, "%s ", ft->name); if (i >= PAGE_SIZE - IFNAMSIZ)
if (i >= PAGE_SIZE)
break; break;
i += snprintf(&buffer[i], IFNAMSIZ, "%s ", ft->name);
} }
mutex_unlock(&ft_mutex); mutex_unlock(&ft_mutex);
if (i == j) if (i == j)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment