提交 fffa6923 编写于 作者: D Dan Carpenter 提交者: James Bottomley

[SCSI] bfa: off by one in bfa_ioc_mbox_isr()

If mc == BFI_MC_MAX then we're reading past the end of the
mod->mbhdlr[] array.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NKrishna Gudipati <kgudipat@brocade.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>
上级 9e1a1537
......@@ -2357,7 +2357,7 @@ bfa_ioc_mbox_isr(struct bfa_ioc_s *ioc)
return;
}
if ((mc > BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
if ((mc >= BFI_MC_MAX) || (mod->mbhdlr[mc].cbfn == NULL))
return;
mod->mbhdlr[mc].cbfn(mod->mbhdlr[mc].cbarg, &m);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册