From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bartlomiej Zolnierkiewicz Subject: Re: [PATCH 2/3] ide: Fix siimage driver accessing beyond array boundary Date: Thu, 18 Oct 2007 23:10:46 +0200 Message-ID: <200710182310.46956.bzolnier@gmail.com> References: <20071018005623.153C7DDEBD@ozlabs.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: Received: from nf-out-0910.google.com ([64.233.182.189]:4700 "EHLO nf-out-0910.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758844AbXJRWu0 (ORCPT ); Thu, 18 Oct 2007 18:50:26 -0400 Received: by nf-out-0910.google.com with SMTP id g13so285704nfb for ; Thu, 18 Oct 2007 15:50:25 -0700 (PDT) In-Reply-To: <20071018005623.153C7DDEBD@ozlabs.org> Content-Disposition: inline Sender: linux-ide-owner@vger.kernel.org List-Id: linux-ide@vger.kernel.org To: Benjamin Herrenschmidt Cc: Linux IDE , linux-kernel@vger.kernel.org, Andrew Morton , stable@kernel.org On Thursday 18 October 2007, Benjamin Herrenschmidt wrote: > The siimage use an incorrect construct to access the other drive > of a pair, causing it to access beyond an array boundary on non-0 > interfaces. This fixes it by using the new ide_get_paired_drive() > hepler instead. > > Signed-off-by: Benjamin Herrenschmidt applied with patch description fixes > --- > > drivers/ide/pci/siimage.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > Index: linux-work/drivers/ide/pci/siimage.c > =================================================================== > --- linux-work.orig/drivers/ide/pci/siimage.c 2007-10-18 10:42:56.000000000 +1000 > +++ linux-work/drivers/ide/pci/siimage.c 2007-10-18 10:43:09.000000000 +1000 > @@ -180,7 +180,7 @@ static void sil_set_pio_mode(ide_drive_t > const u16 data_speed[] = { 0x328a, 0x2283, 0x1104, 0x10c3, 0x10c1 }; > > ide_hwif_t *hwif = HWIF(drive); > - ide_drive_t *pair = &hwif->drives[drive->dn ^ 1]; > + ide_drive_t *pair = ide_get_paired_drive(drive); > u32 speedt = 0; > u16 speedp = 0; > unsigned long addr = siimage_seldev(drive, 0x04);