summaryrefslogtreecommitdiffstats
path: root/drivers/scsi/isci/probe_roms.c
diff options
context:
space:
mode:
authorMaciej Patelczyk <maciej.patelczyk@intel.com>2011-06-22 00:03:13 +0200
committerDan Williams <dan.j.williams@intel.com>2011-07-03 13:04:51 +0200
commit7cafbf1bd56be44038148bb8f733ea6e6a6a2d53 (patch)
treecaf063a0640a33d37b198c3dd5c71ce04247a493 /drivers/scsi/isci/probe_roms.c
parentisci: fix isci_task_execute_tmf completion (diff)
downloadlinux-7cafbf1bd56be44038148bb8f733ea6e6a6a2d53.tar.xz
linux-7cafbf1bd56be44038148bb8f733ea6e6a6a2d53.zip
isci: possible buffer overflow in isci_parse_oem_parameters fixed
scu_index is a parameter of isci_parse_eom_parameters and is an index in controller table. There is a check: scu_index > SCI_MAX_CONTROLLERS which is insufficient and should be: scu_index >= SCI_MAX_CONTROLLERS. scu_index is used as an index in the table which size is SCI_MAX_CONTROLLERS. Signed-off-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/scsi/isci/probe_roms.c')
-rw-r--r--drivers/scsi/isci/probe_roms.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/isci/probe_roms.c b/drivers/scsi/isci/probe_roms.c
index bc52a6174070..99b13c191877 100644
--- a/drivers/scsi/isci/probe_roms.c
+++ b/drivers/scsi/isci/probe_roms.c
@@ -125,7 +125,7 @@ enum sci_status isci_parse_oem_parameters(union scic_oem_parameters *oem_params,
struct isci_orom *orom, int scu_index)
{
/* check for valid inputs */
- if (scu_index < 0 || scu_index > SCI_MAX_CONTROLLERS ||
+ if (scu_index < 0 || scu_index >= SCI_MAX_CONTROLLERS ||
scu_index > orom->hdr.num_elements || !oem_params)
return -EINVAL;