Browse Source

[SCSI] bfa: off by one in bfa_ioc_mbox_isr()

If mc == BFI_MC_MAX then we're reading past the end of the
mod->mbhdlr[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Krishna Gudipati <kgudipat@brocade.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Dan Carpenter 13 năm trước cách đây
mục cha
commit
fffa69230b
1 tập tin đã thay đổi với 1 bổ sung1 xóa
  1. 1 1
      drivers/scsi/bfa/bfa_ioc.c

+ 1 - 1
drivers/scsi/bfa/bfa_ioc.c

@@ -2357,7 +2357,7 @@ bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc)
 			return;
 			return;
 		}
 		}
 
 
-		if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
+		if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
 			return;
 			return;
 
 
 		mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);
 		mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);