hptiop: avoid buffer overflow when returning sense data

patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline.

avoid buffer overflow when returning sense data.

With current adapter firmware the driver is working but future firmware
updates may return sense data larger than 96 bytes, causing overflow on
scp->sense_buffer and a kernel crash.

This fix should be backported to earlier kernels.

Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: James Bottomley <James.Bottomley@steeleye.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index bec83cbee59a6abe9cb36ca4d15bb0d384fb5f7b..7e40105dd2bda162a3e641e20f90f908d962c06a 100644 (file)
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -377,8 +377,9 @@ static void hptiop_host_request_callback(struct hptiop_hba *hba, u32 tag)
                scp->result = SAM_STAT_CHECK_CONDITION;
                memset(&scp->sense_buffer,
                                0, sizeof(scp->sense_buffer));
-               memcpy(&scp->sense_buffer,
-                       &req->sg_list, le32_to_cpu(req->dataxfer_length));
+               memcpy(&scp->sense_buffer, &req->sg_list,
+                               min(sizeof(scp->sense_buffer),
+                                       le32_to_cpu(req->dataxfer_length)));
                break;
 
        default: