| commit | 14e45c15e1dcc4d972b41343661683efd60fed72 | [log] [tgz] |
|---|---|---|
| author | Dan Carpenter <error27@gmail.com> | Wed Jun 09 14:01:54 2010 +0200 |
| committer | Jeff Garzik <jgarzik@redhat.com> | Thu Jun 10 16:06:33 2010 -0400 |
| tree | 96635555f499e15ae8b0eb2a0e0d45233544f80b | |
| parent | 7908a9e5fc3f9a679b1777ed231a03636c068446 [diff] |
sata_sil24: memset() overflow cb->atapi.cdb is an array of 16 u8 elements. The call too memset() would set the first part of the sge array to zero as well. It's not a packed struct. This one has been around for five years. I found it with Smatch. I think the reason no one has seen it before is because we normally call sil24_fill_sg() and that overwrites sge with proper information? Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>