From f25f84b7962f63994585fdbce9e797a41fb5485e Mon Sep 17 00:00:00 2001
From: Daniel Verkamp <daniel.verkamp@intel.com>
Date: Tue, 11 Jul 2017 13:48:31 -0700
Subject: [PATCH] scsi: fix off-by-one error in spdk_scsi_dev_get_lun()

lun_id could potentially overflow the dev->lun array bounds if it was
equal to dev->maxlun, which is actually the maximum lun array index plus
one, not the maximum valid LUN index.

Change-Id: I5662c6f6fa634a7dd755c9bfc1a24d3c4cabe7ea
Reported-by: Dariusz Stojaczyk <dariuszx.stojaczyk@intel.com>
Signed-off-by: Daniel Verkamp <daniel.verkamp@intel.com>
Reviewed-on: https://review.gerrithub.io/369074
Tested-by: SPDK Automated Test System <sys_sgsw@intel.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
Reviewed-by: Jim Harris <james.r.harris@intel.com>
---
 lib/scsi/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/scsi/dev.c b/lib/scsi/dev.c
index 9f19f4fbd..f8f33a044 100644
--- a/lib/scsi/dev.c
+++ b/lib/scsi/dev.c
@@ -331,7 +331,7 @@ spdk_scsi_dev_get_max_lun(const struct spdk_scsi_dev *dev)
 struct spdk_scsi_lun *
 spdk_scsi_dev_get_lun(struct spdk_scsi_dev *dev, int lun_id)
 {
-	if (lun_id < 0 || lun_id > dev->maxlun) {
+	if (lun_id < 0 || lun_id >= dev->maxlun) {
 		return NULL;
 	}