|
@@ -880,7 +880,7 @@ static int dax_ccb_exec(struct dax_ctx *ctx, const char __user *buf,
|
|
dax_dbg("args: ccb_buf_len=%ld, idx=%d", count, idx);
|
|
dax_dbg("args: ccb_buf_len=%ld, idx=%d", count, idx);
|
|
|
|
|
|
/* for given index and length, verify ca_buf range exists */
|
|
/* for given index and length, verify ca_buf range exists */
|
|
- if (idx + nccbs >= DAX_CA_ELEMS) {
|
|
|
|
|
|
+ if (idx < 0 || idx > (DAX_CA_ELEMS - nccbs)) {
|
|
ctx->result.exec.status = DAX_SUBMIT_ERR_NO_CA_AVAIL;
|
|
ctx->result.exec.status = DAX_SUBMIT_ERR_NO_CA_AVAIL;
|
|
return 0;
|
|
return 0;
|
|
}
|
|
}
|