Skip to contentSkip to conversation

cxlflash: a couple off by one bugs

PATCH In review Dan Carpenter 3 participants 3 messages Sep 22, 2015

Subsystems (2)
SCSI Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 cxlflash: a couple off by one bugs

The "> MAX_CONTEXT" should be ">= MAX_CONTEXT". Otherwise we go one step beyond the end of the cfg->ctx_tbl[] array.

Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/cxlflash/superpipe.c +2 -2
index f1b62ce..05e0ecf 100644
@@ -1315,7 +1315,7 @@ static int cxlflash_disk_attach(struct scsi_device *sdev,
 	}
 
 	ctxid = cxl_process_element(ctx);
-	if (unlikely((ctxid > MAX_CONTEXT) || (ctxid < 0))) {
+	if (unlikely((ctxid >= MAX_CONTEXT) || (ctxid < 0))) {
 		dev_err(dev, "%s: ctxid (%d) invalid!\n", __func__, ctxid);
 		rc = -EPERM;
 		goto err1;

@@ -1440,7 +1440,7 @@ static int recover_context(struct cxlflash_cfg *cfg, struct ctx_info *ctxi)
 	}
 
 	ctxid = cxl_process_element(ctx);
-	if (unlikely((ctxid > MAX_CONTEXT) || (ctxid < 0))) {
+	if (unlikely((ctxid >= MAX_CONTEXT) || (ctxid < 0))) {
 		dev_err(dev, "%s: ctxid (%d) invalid!\n", __func__, ctxid);
 		rc = -EPERM;
 		goto err1;
Reviewed-by on v1 1/1
#1 lore raw
Reviewed-by Manoj Kumar <[email protected]>

---
Manoj Kumar

Quoted 28 lines · Dan Carpenter

The "> MAX_CONTEXT" should be ">= MAX_CONTEXT". Otherwise we go one step beyond the end of the cfg->ctx_tbl[] array.

Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/cxlflash/superpipe.c +2 -2
index f1b62ce..05e0ecf 100644
@@ -1315,7 +1315,7 @@ static int cxlflash_disk_attach(struct scsi_device *sdev,
  	}
 
  	ctxid = cxl_process_element(ctx);
-	if (unlikely((ctxid > MAX_CONTEXT) || (ctxid < 0))) {
+	if (unlikely((ctxid >= MAX_CONTEXT) || (ctxid < 0))) {
  		dev_err(dev, "%s: ctxid (%d) invalid!\n", __func__, ctxid);
  		rc = -EPERM;
  		goto err1;

@@ -1440,7 +1440,7 @@ static int recover_context(struct cxlflash_cfg *cfg, struct ctx_info *ctxi)
  	}
 
  	ctxid = cxl_process_element(ctx);
-	if (unlikely((ctxid > MAX_CONTEXT) || (ctxid < 0))) {
+	if (unlikely((ctxid >= MAX_CONTEXT) || (ctxid < 0))) {
  		dev_err(dev, "%s: ctxid (%d) invalid!\n", __func__, ctxid);
  		rc = -EPERM;
  		goto err1;
Acked-by on v1 1/1
#2 lore raw
In reply to Dan Carpenter
Quoted 4 lines · Dan Carpenter

The "> MAX_CONTEXT" should be ">= MAX_CONTEXT". Otherwise we go one step beyond the end of the cfg->ctx_tbl[] array.

Acked-by Matthew R. Ochs <[email protected]>
Quoted 26 lines
Signed-off-by Dan Carpenter <[email protected]>
drivers/scsi/cxlflash/superpipe.c +2 -2
index f1b62ce..05e0ecf 100644
@@ -1315,7 +1315,7 @@ static int cxlflash_disk_attach(struct scsi_device *sdev,
 	}
 
 	ctxid = cxl_process_element(ctx);
-	if (unlikely((ctxid > MAX_CONTEXT) || (ctxid < 0))) {
+	if (unlikely((ctxid >= MAX_CONTEXT) || (ctxid < 0))) {
 		dev_err(dev, "%s: ctxid (%d) invalid!\n", __func__, ctxid);
 		rc = -EPERM;
 		goto err1;

@@ -1440,7 +1440,7 @@ static int recover_context(struct cxlflash_cfg *cfg, struct ctx_info *ctxi)
 	}
 
 	ctxid = cxl_process_element(ctx);
-	if (unlikely((ctxid > MAX_CONTEXT) || (ctxid < 0))) {
+	if (unlikely((ctxid >= MAX_CONTEXT) || (ctxid < 0))) {
 		dev_err(dev, "%s: ctxid (%d) invalid!\n", __func__, ctxid);
 		rc = -EPERM;
 		goto err1;