Re: [PATCH] lpfc: Read buffer overflow

[Joe Eykholt <jeykholt@cisco.com>]

James Smart wrote:
> NACK -  the vports array is created such that it is sized for 
> phba->max_vports + 1.

It's not an off-by-one problem, it's a look-before-leaping problem.

	Regards,
	Joe

> 
> -- james s
> 
> Roel Kluin wrote:
>> Check whether index is within bounds before testing the element.
>>
>> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
>> ---
>> diff --git a/drivers/scsi/lpfc/lpfc_vport.c 
>> b/drivers/scsi/lpfc/lpfc_vport.c
>> index e0b4992..ade2df6 100644
>> --- a/drivers/scsi/lpfc/lpfc_vport.c
>> +++ b/drivers/scsi/lpfc/lpfc_vport.c
>> @@ -762,7 +762,7 @@ lpfc_destroy_vport_work_array(struct lpfc_hba 
>> *phba, struct lpfc_vport **vports)
>>      int i;
>>      if (vports == NULL)
>>          return;
>> -    for (i = 0; vports[i] != NULL && i <= phba->max_vports; i++)
>> +    for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++)
>>          scsi_host_put(lpfc_shost_from_vport(vports[i]));
>>      kfree(vports);
>>  }
>>
>>   
> -- 
> To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html