Commit b3d9f279 authored by Andrew Morton's avatar Andrew Morton Committed by Jens Axboe

[PATCH] cciss, fix array bounds overrun

Patch from steve cameron <steve.cameron@hp.com>

Fix overrun if you have more than 16 attached tape drives + tape changers.
Thanks to Mike Anderson for pointing this out.
parent 3aee2f2f
...@@ -1106,6 +1106,12 @@ cciss_update_non_disk_devices(int cntl_num, int hostno) ...@@ -1106,6 +1106,12 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
{ {
case 0x01: /* sequential access, (tape) */ case 0x01: /* sequential access, (tape) */
case 0x08: /* medium changer */ case 0x08: /* medium changer */
if (ncurrent >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
printk(KERN_INFO "cciss%d: %s ignored, "
"too many devices.\n", cntl_num,
DEVICETYPE(devtype));
break;
}
memcpy(&currentsd[ncurrent].scsi3addr[0], memcpy(&currentsd[ncurrent].scsi3addr[0],
&scsi3addr[0], 8); &scsi3addr[0], 8);
currentsd[ncurrent].devtype = devtype; currentsd[ncurrent].devtype = devtype;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment