Skip to contentSkip to conversation

cxlflash: off by one bug in cxlflash_show_port_status()

PATCH In review Dan Carpenter 2 participants 2 messages Aug 14, 2015 – Aug 16, 2015

Subsystems (2)
SCSI Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 cxlflash: off by one bug in cxlflash_show_port_status()

The > should be >= or we read one element past the end of the array.

Fixes c21e0bbfc485 ('cxlflash: Base support for IBM CXL Flash Adapter')
Signed-off-by Dan Carpenter <[email protected]>
Fixes c21e0bbfc485 ('cxlflash: Base support for IBM CXL Flash Adapter')
drivers/scsi/cxlflash/main.c +1 -1
index 0720d2f..fd70101 100644
@@ -539,7 +539,7 @@ static ssize_t cxlflash_show_port_status(struct device *dev,
 	u64 *fc_regs;
 
 	rc = kstrtouint((attr->attr.name + 4), 10, &port);
-	if (rc || (port > NUM_FC_PORTS))
+	if (rc || (port >= NUM_FC_PORTS))
 		return 0;
 
 	fc_regs = &afu->afu_map->global.fc_regs[port][0];
Acked-by on v1 1/1
#1 lore raw
Quoted 3 lines · Dan Carpenter

The > should be >= or we read one element past the end of the array.

Dan - Good catch!

Acked-by Matthew R. Ochs <[email protected]>
Quoted 19 lines
Fixes c21e0bbfc485 ('cxlflash: Base support for IBM CXL Flash Adapter')
Signed-off-by Dan Carpenter <[email protected]>
Fixes c21e0bbfc485 ('cxlflash: Base support for IBM CXL Flash Adapter')
drivers/scsi/cxlflash/main.c +1 -1
index 0720d2f..fd70101 100644
@@ -539,7 +539,7 @@ static ssize_t cxlflash_show_port_status(struct device *dev,
 	u64 *fc_regs;
 
 	rc = kstrtouint((attr->attr.name + 4), 10, &port);
-	if (rc || (port > NUM_FC_PORTS))
+	if (rc || (port >= NUM_FC_PORTS))
 		return 0;
 
 	fc_regs = &afu->afu_map->global.fc_regs[port][0];