From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755268Ab2F0I7u (ORCPT ); Wed, 27 Jun 2012 04:59:50 -0400 Received: from acsinet15.oracle.com ([141.146.126.227]:19668 "EHLO acsinet15.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754457Ab2F0I7s (ORCPT ); Wed, 27 Jun 2012 04:59:48 -0400 Date: Wed, 27 Jun 2012 11:59:36 +0300 From: Dan Carpenter To: Jing Huang Cc: Krishna C Gudipati , "James E.J. Bottomley" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch -resend] [SCSI] bfa: off by one in bfa_ioc_mbox_isr() Message-ID: <20120627085936.GA31212@elgon.mountain> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20120627085800.GA3007@mwanda> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If mc == BFI_MC_MAX then we're reading past the end of the mod->mbhdlr[] array. Signed-off-by: Dan Carpenter --- Originally sent on Wed, 6 Jul 2011. diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c index 14e6284..8cdb79c 100644 --- a/drivers/scsi/bfa/bfa_ioc.c +++ b/drivers/scsi/bfa/bfa_ioc.c @@ -2357,7 +2357,7 @@ bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc) return; } - if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL)) + if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL)) return; mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m); From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Wed, 27 Jun 2012 08:59:36 +0000 Subject: [patch -resend] [SCSI] bfa: off by one in bfa_ioc_mbox_isr() Message-Id: <20120627085936.GA31212@elgon.mountain> List-Id: References: <20120627085800.GA3007@mwanda> In-Reply-To: <20120627085800.GA3007@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Jing Huang Cc: Krishna C Gudipati , "James E.J. Bottomley" , linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org If mc = BFI_MC_MAX then we're reading past the end of the mod->mbhdlr[] array. Signed-off-by: Dan Carpenter --- Originally sent on Wed, 6 Jul 2011. diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c index 14e6284..8cdb79c 100644 --- a/drivers/scsi/bfa/bfa_ioc.c +++ b/drivers/scsi/bfa/bfa_ioc.c @@ -2357,7 +2357,7 @@ bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc) return; } - if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn = NULL)) + if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn = NULL)) return; mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);