[PATCH] 2.5.60, cciss, fix array bounds overrun

steve cameron (steve.cameron@hp.com)
Fri, 14 Feb 2003 13:03:17 +0600


Fix overrun if you have more than 16 attached tape drives + tape changers.
Thanks to Mike Anderson for pointing this out.

-- steve

--- lx2560/drivers/block/cciss_scsi.c~currentsd_overrun 2003-02-14 12:53:35.000000000 +0600
+++ lx2560-scameron/drivers/block/cciss_scsi.c 2003-02-14 12:59:34.000000000 +0600
@@ -1106,6 +1106,12 @@ cciss_update_non_disk_devices(int cntl_n
{
case 0x01: /* sequential access, (tape) */
case 0x08: /* medium changer */
+ if (ncurrent >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
+ printk(KERN_INFO "cciss%d: %s ignored, "
+ "too many devices.\n", cntl_num,
+ DEVICETYPE(devtype));
+ break;
+ }
memcpy(&currentsd[ncurrent].scsi3addr[0],
&scsi3addr[0], 8);
currentsd[ncurrent].devtype = devtype;

_
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/