Commit e0783ed3 authored by Finn Thain's avatar Finn Thain Committed by Martin K. Petersen
Browse files

ncr5380: Fix off-by-one bug in extended_msg[] bounds check 



Fix the array bounds check when transferring an extended message from the
target.

Signed-off-by: default avatarFinn Thain <fthain@telegraphics.com.au>
Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
Tested-by: default avatarOndrej Zary <linux@rainbow-software.org>
Tested-by: default avatarMichael Schmitz <schmitzmic@gmail.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 72064a78

drivers/scsi/NCR5380.c

+2 −1
Original line number Diff line number Diff line
@@ -2039,7 +2039,8 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) { 


					dprintk(NDEBUG_EXTENDED, "scsi%d : length=%d, code=0x%02x\n", instance->host_no, (int) extended_msg[1], (int) extended_msg[2]);



					if (!len && extended_msg[1] <= (sizeof(extended_msg) - 1)) {

					if (!len && extended_msg[1] > 0 &&

					    extended_msg[1] <= sizeof(extended_msg) - 2) {

						/* Accept third byte by clearing ACK */

						NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);

						len = extended_msg[1] - 1;

drivers/scsi/atari_NCR5380.c

+2 −2
Original line number Diff line number Diff line
@@ -2330,8 +2330,8 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) 
					dprintk(NDEBUG_EXTENDED, "scsi%d: length=%d, code=0x%02x\n", HOSTNO,

						   (int)extended_msg[1], (int)extended_msg[2]);



					if (!len && extended_msg[1] <=

					    (sizeof(extended_msg) - 1)) {

					if (!len && extended_msg[1] > 0 &&

					    extended_msg[1] <= sizeof(extended_msg) - 2) {

						/* Accept third byte by clearing ACK */

						NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);

						len = extended_msg[1] - 1;

CRA Git | Maintained and supported by SUSTech CRA and CCSE