target: fix pr_out length in iscsi_parse_pr_out_transport_id

Old code in iscsi_parse_pr_out_transport_id() was obviously buggy
and effectively ignored the high byte.

Found by coverity.

Signed-off-by: Joern Engel <joern@logfs.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
index 0d1cf8b4f49f64a182287f1c74e05a841fce6a30..35bfe77160d86828b6511034787862f74788addc 100644 (file)
--- a/drivers/target/target_core_fabric_lib.c
+++ b/drivers/target/target_core_fabric_lib.c
@@ -394,9 +394,9 @@ char *iscsi_parse_pr_out_transport_id(
         * If the caller wants the TransportID Length, we set that value for the
         * entire iSCSI Tarnsport ID now.
         */
-        if (out_tid_len != NULL) {
-               add_len = ((buf[2] >> 8) & 0xff);
-               add_len |= (buf[3] & 0xff);
+       if (out_tid_len) {
+               /* The shift works thanks to integer promotion rules */
+               add_len = (buf[2] << 8) | buf[3];
 
                tid_len = strlen(&buf[4]);
                tid_len += 4; /* Add four bytes for iSCSI Transport ID header */