Skip to content

Commit

Permalink
[SCSI] bfa: off by one in bfa_ioc_mbox_isr()
Browse files Browse the repository at this point in the history
If mc == BFI_MC_MAX then we're reading past the end of the
mod->mbhdlr[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Krishna Gudipati <kgudipat@brocade.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
  • Loading branch information
Dan Carpenter authored and James Bottomley committed Jul 20, 2012
1 parent 9e1a153 commit fffa692
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/scsi/bfa/bfa_ioc.c
Original file line number Diff line number Diff line change
Expand Up @@ -2357,7 +2357,7 @@ bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc)
return;
}

if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
return;

mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);
Expand Down

0 comments on commit fffa692

Please sign in to comment.