ivampiresp/Spdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scsi: fix off-by-one error in spdk_scsi_dev_get_lun()

Browse Source 
lun_id could potentially overflow the dev->lun array bounds if it was
equal to dev->maxlun, which is actually the maximum lun array index plus
one, not the maximum valid LUN index.

Change-Id: I5662c6f6fa634a7dd755c9bfc1a24d3c4cabe7ea
Reported-by: Dariusz Stojaczyk <dariuszx.stojaczyk@intel.com>
Signed-off-by: Daniel Verkamp <daniel.verkamp@intel.com>
Reviewed-on: https://review.gerrithub.io/369074
Tested-by: SPDK Automated Test System <sys_sgsw@intel.com>
Reviewed-by: Ben Walker <benjamin.walker@intel.com>
Reviewed-by: Jim Harris <james.r.harris@intel.com>
This commit is contained in:
Daniel Verkamp 2017-07-11 13:48:31 -07:00 committed by Jim Harris
parent e2f42584b0
commit f25f84b796
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/scsi/dev.c
View File

@ -331,7 +331,7 @@ spdk_scsi_dev_get_max_lun(const struct spdk_scsi_dev *dev)
struct spdk_scsi_lun *
spdk_scsi_dev_get_lun(struct spdk_scsi_dev *dev, int lun_id)
{
if (lun_id < 0 || lun_id > dev->maxlun) {
if (lun_id < 0 || lun_id >= dev->maxlun) {
return NULL;
}