diff options
author | Finn Thain <fthain@telegraphics.com.au> | 2016-01-03 16:05:45 +1100 |
---|---|---|
committer | Martin K. Petersen <martin.petersen@oracle.com> | 2016-01-06 21:43:02 -0500 |
commit | e0783ed3660aecb83af580cdace583980b22809b (patch) | |
tree | 3a6190115137d208386cd2e8e93fbe61e95dd091 /drivers/scsi/atari_NCR5380.c | |
parent | 72064a783b0c24dc4325295ffba949c115aff6d2 (diff) | |
download | linux-e0783ed3660aecb83af580cdace583980b22809b.tar.gz linux-e0783ed3660aecb83af580cdace583980b22809b.tar.bz2 linux-e0783ed3660aecb83af580cdace583980b22809b.zip |
ncr5380: Fix off-by-one bug in extended_msg[] bounds check
Fix the array bounds check when transferring an extended message from the
target.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Tested-by: Ondrej Zary <linux@rainbow-software.org>
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/atari_NCR5380.c')
-rw-r--r-- | drivers/scsi/atari_NCR5380.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c index 214f43b4baad..c14cfb1cc3dd 100644 --- a/drivers/scsi/atari_NCR5380.c +++ b/drivers/scsi/atari_NCR5380.c @@ -2330,8 +2330,8 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) dprintk(NDEBUG_EXTENDED, "scsi%d: length=%d, code=0x%02x\n", HOSTNO, (int)extended_msg[1], (int)extended_msg[2]); - if (!len && extended_msg[1] <= - (sizeof(extended_msg) - 1)) { + if (!len && extended_msg[1] > 0 && + extended_msg[1] <= sizeof(extended_msg) - 2) { /* Accept third byte by clearing ACK */ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE); len = extended_msg[1] - 1; |