public inbox for linux-scsi@vger.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: linux@rainbow-software.org
Cc: linux-scsi@vger.kernel.org
Subject: re: aha1542: Stop using scsi_module.c
Date: Wed, 4 May 2016 08:55:42 +0300	[thread overview]
Message-ID: <20160504055542.GA19150@mwanda> (raw)

Hello Ondrej Zary,

The patch 643a7c43f11e: "aha1542: Stop using scsi_module.c" from Feb
6, 2015, leads to the following static checker warning:

	drivers/scsi/aha1542.c:703 aha1542_hw_init()
	error: buffer overflow 'io' 4 <= 4

drivers/scsi/aha1542.c
   995  static int aha1542_pnp_probe(struct pnp_dev *pdev, const struct pnp_device_id *id)
   996  {
   997          int indx;
   998          struct Scsi_Host *sh;
   999  
  1000          for (indx = 0; indx < ARRAY_SIZE(io); indx++) {
                               ^^^^^^^^^^^^^^^^^^^^^
Let's assume we exit the loop with indx == ARRAY_SIZE(io).  Actually,
that's the only way we can exit the loop.


  1001                  if (io[indx])
  1002                          continue;
  1003  
  1004                  if (pnp_activate_dev(pdev) < 0)
  1005                          continue;
  1006  
  1007                  io[indx] = pnp_port_start(pdev, 0);
  1008  
  1009                  /* The card can be queried for its DMA, we have
  1010                     the DMA set up that is enough */
  1011  
  1012                  dev_info(&pdev->dev, "ISAPnP found an AHA1535 at I/O 0x%03X", io[indx]);
  1013          }
  1014  
  1015          sh = aha1542_hw_init(&driver_template, &pdev->dev, indx);
                                                                   ^^^^
Then this is beyond the end of the array.  I'm not sure what was
intended.

  1016          if (!sh)
  1017                  return -ENODEV;
  1018  
  1019          pnp_set_drvdata(pdev, sh);
  1020          return 0;
  1021  }

regards,
dan carpenter

                 reply	other threads:[~2016-05-04  5:55 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160504055542.GA19150@mwanda \
    --to=dan.carpenter@oracle.com \
    --cc=linux-scsi@vger.kernel.org \
    --cc=linux@rainbow-software.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox