Browse Source

tcmu: Fix some memory corruption

"udev->nl_reply_supported" is an int but on 64 bit arches we are writing
8 bytes of data to it so it corrupts four bytes beyond the end of the
struct.

Fixes: b849b4567549 ("target: Add netlink command reply supported option for each device")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Dan Carpenter 7 years ago
parent
commit
16b9327704
1 changed files with 2 additions and 3 deletions
  1. 2 3
      drivers/target/target_core_user.c

+ 2 - 3
drivers/target/target_core_user.c

@@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
 				ret = -ENOMEM;
 				break;
 			}
-			ret = kstrtol(arg_p, 0,
-					(long int *) &udev->nl_reply_supported);
+			ret = kstrtoint(arg_p, 0, &udev->nl_reply_supported);
 			kfree(arg_p);
 			if (ret < 0)
-				pr_err("kstrtoul() failed for nl_reply_supported=\n");
+				pr_err("kstrtoint() failed for nl_reply_supported=\n");
 			break;
 		default:
 			break;