From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeremy Fitzhardinge Subject: Re: [PATCH] xen/blkfront: beyond ARRAY_SIZE of info->shadow Date: Thu, 21 May 2009 11:48:40 -0700 Message-ID: <4A15A208.5070206@goop.org> References: <4A15A0D2.7090209@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4A15A0D2.7090209@gmail.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Roel Kluin Cc: virtualization@lists.osdl.org, Andrew Morton , xen-devel@lists.xensource.com, jeremy@xensource.com, Jens Axboe List-Id: virtualization@lists.linuxfoundation.org Roel Kluin wrote: > Do not go beyond ARRAY_SIZE of info->shadow > > Signed-off-by: Roel Kluin > Acked-by: Jeremy Fitzhardinge Jens, can you put this into a next-merge-window branch? Thanks, J > --- > diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c > index a6cbf7b..d395986 100644 > --- a/drivers/block/xen-blkfront.c > +++ b/drivers/block/xen-blkfront.c > @@ -122,7 +122,7 @@ static DEFINE_SPINLOCK(blkif_io_lock); > static int get_id_from_freelist(struct blkfront_info *info) > { > unsigned long free = info->shadow_free; > - BUG_ON(free > BLK_RING_SIZE); > + BUG_ON(free >= BLK_RING_SIZE); > info->shadow_free = info->shadow[free].req.id; > info->shadow[free].req.id = 0x0fffffee; /* debug */ > return free; > > _______________________________________________ > Virtualization mailing list > Virtualization@lists.linux-foundation.org > https://lists.linux-foundation.org/mailman/listinfo/virtualization > >