| Message ID | 20171108084344.hmqtb5k2puzh3sc6@mwanda (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
On Wed, 2017-11-08 at 11:43 +0300, Dan Carpenter wrote: > "udev->nl_reply_supported" is an int but on 64 bit arches we are writing > 8 bytes of data to it so it corrupts four bytes beyond the end of the > struct. > > Fixes: b849b4567549 ("target: Add netlink command reply supported option for each device") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > Applied to target-pending/for-next.
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c index 3be4c9696d19..07f2d95f7ae7 100644 --- a/drivers/target/target_core_user.c +++ b/drivers/target/target_core_user.c @@ -1724,11 +1724,10 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev, ret = -ENOMEM; break; } - ret = kstrtol(arg_p, 0, - (long int *) &udev->nl_reply_supported); + ret = kstrtoint(arg_p, 0, &udev->nl_reply_supported); kfree(arg_p); if (ret < 0) - pr_err("kstrtoul() failed for nl_reply_supported=\n"); + pr_err("kstrtoint() failed for nl_reply_supported=\n"); break; default: break;
"udev->nl_reply_supported" is an int but on 64 bit arches we are writing 8 bytes of data to it so it corrupts four bytes beyond the end of the struct. Fixes: b849b4567549 ("target: Add netlink command reply supported option for each device") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>