projects
/
kernel
/
kernel-generic.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
9e1a153
)
[SCSI] bfa: off by one in bfa_ioc_mbox_isr()
author
Dan Carpenter
<dan.carpenter@oracle.com>
Wed, 27 Jun 2012 08:59:36 +0000
(11:59 +0300)
committer
James Bottomley
<JBottomley@Parallels.com>
Fri, 20 Jul 2012 07:58:37 +0000
(08:58 +0100)
If mc == BFI_MC_MAX then we're reading past the end of the
mod->mbhdlr[] array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Krishna Gudipati <kgudipat@brocade.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
drivers/scsi/bfa/bfa_ioc.c
patch
|
blob
|
history
diff --git
a/drivers/scsi/bfa/bfa_ioc.c
b/drivers/scsi/bfa/bfa_ioc.c
index
14e6284
..
8cdb79c
100644
(file)
--- a/
drivers/scsi/bfa/bfa_ioc.c
+++ b/
drivers/scsi/bfa/bfa_ioc.c
@@
-2357,7
+2357,7
@@
bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc)
return;
}
- if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
+ if ((mc >
=
BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
return;
mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);