* [patch 1/2] [SCSI] bfa: off by one in bfa_ioc_mbox_isr()
@ 2011-07-06 7:36 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2011-07-06 7:36 UTC (permalink / raw)
To: Jing Huang
Cc: James E.J. Bottomley, open list:BROCADE BFA FC SC..., open list,
kernel-janitors
If mc == BFI_MC_MAX then we're reading past the end of the
mod->mbhdlr[] array.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
index d6c2bf3..052373b 100644
--- a/drivers/scsi/bfa/bfa_ioc.c
+++ b/drivers/scsi/bfa/bfa_ioc.c
@@ -2378,7 +2378,7 @@ bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc)
return;
}
- if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
+ if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
return;
mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-07-06 7:36 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-07-06 7:36 [patch 1/2] [SCSI] bfa: off by one in bfa_ioc_mbox_isr() Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox