nsp32: fix an off by one
PATCH 1/1 nsp32: fix an off by one
This off by one bug will cause memory corruption when we use every sglun.
The problem is that NSP32_SG_TABLE_SIZE is too small. Here is how it's caculated in the original code:
sizeof(nsp32_sgtable) * NSP32_SG_SIZE * MAX_TARGET * MAX_LUN
But the problem is that the NSP32_SG_SIZE should be (NSP32_SG_SIZE + 1) like this:
sizeof(nsp32_sgtable) * (NSP32_SG_SIZE + 1) * MAX_TARGET * MAX_LUN
Or another more intuitive way to write it would be:
sizeof(nsp32_sglun) * MAX_TARGET * MAX_LUN
We use NSP32_SG_TABLE_SIZE to allocate data->sg_list which is an array of nsp32_sglun structs. The array has MAX_TARGET * MAX_LUN elements.
MAX_TARGET (8) * MAX_LUN (8) = 64 elements. The missing "+ 1" means that we only allocate enough space for 63 elements. In terms of bytes, the old code allocated 65536 bytes and now it allocates 66048 bytes.
---
Static checker stuff.
drivers/scsi/nsp32.h +1 -1
@@ -454,7 +454,7 @@ typedef struct _nsp32_sgtable {typedef struct _nsp32_sglun {nsp32_sgtable sgt[NSP32_SG_SIZE +1 ];/* SG table */ } __attribute__ ((packed))nsp32_sglun ; -#define NSP32_SG_TABLE_SIZE (sizeof(nsp32_sgtable) * NSP32_SG_SIZE * MAX_TARGET * MAX_LUN) +#define NSP32_SG_TABLE_SIZE (sizeof(nsp32_sglun) * MAX_TARGET * MAX_LUN)/* Auto parameter mode memory map. */ /* All values must be little endian. */