Carlos,

> If ecdb_ahdr->ahslength is zero, two bugs follow:
>
>   kmalloc(be16_to_cpu(ecdb_ahdr->ahslength) + 15, ...)
>
> allocates 15 bytes, but the immediately following memcpy writes
> ISCSI_CDB_SIZE (16) bytes into it, a one-byte heap overflow. Also:

Applied to 7.1/scsi-staging, thanks!

-- 
Martin K. Petersen