diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-06-27 11:59:36 +0300 |
|---|---|---|
| committer | James Bottomley <JBottomley@Parallels.com> | 2012-07-20 08:58:37 +0100 |
| commit | fffa69230b7bbfc62d8cfb515c3e658224a0f88c (patch) | |
| tree | 6262e3adfbd29308650c46f529888d4bf5b5d464 | |
| parent | 9e1a15376bce2fc7746145eb8ee78a3674658bc8 (diff) | |
| download | op-kernel-dev-fffa69230b7bbfc62d8cfb515c3e658224a0f88c.zip op-kernel-dev-fffa69230b7bbfc62d8cfb515c3e658224a0f88c.tar.gz | |
[SCSI] bfa: off by one in bfa_ioc_mbox_isr()
If mc == BFI_MC_MAX then we're reading past the end of the
mod->mbhdlr[] array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Krishna Gudipati <kgudipat@brocade.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
| -rw-r--r-- | drivers/scsi/bfa/bfa_ioc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c index 14e6284..8cdb79c 100644 --- a/drivers/scsi/bfa/bfa_ioc.c +++ b/drivers/scsi/bfa/bfa_ioc.c @@ -2357,7 +2357,7 @@ bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc) return; } - if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL)) + if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL)) return; mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m); |
