[PATCH] sym53c8xx: Read buffer overflow

[PATCH] sym53c8xx: Read buffer overflow

[Roel Kluin]

Prevent read from div_10M[-1] when no clock divisor was greater.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
Can this happen?

diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index 297deb8..230add3 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -542,6 +542,9 @@ sym_getsync(struct sym_hcb *np, u_char dt, u_char sfac, u_char *divp, u_char *fa
 	while (div-- > 0)
 		if (kpc >= (div_10M[div] << 2)) break;
 
+	if (div < 0)
+		return -1;
+
 	/*
 	 *  Calculate the lowest clock factor that allows an output 
 	 *  speed not faster than the period, and the max output speed.

Re: [PATCH] sym53c8xx: Read buffer overflow

[James Bottomley]

On Sun, 2009-08-09 at 16:16 +0200, Roel Kluin wrote:
> Prevent read from div_10M[-1] when no clock divisor was greater.
> 
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> ---
> Can this happen?

No: The low values are only possible for lower periods.  125 is the min
period this chip would ever accept (u160) and in order to support that
it has to have a master clock at 160MHz.

James