From patchwork Thu Mar 31 03:51:07 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Keng-Yu Lin X-Patchwork-Id: 89013 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 20E7CB6F74 for ; Thu, 31 Mar 2011 14:52:46 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Q58w5-0002qZ-0p; Thu, 31 Mar 2011 03:52:41 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Q58vY-0002d3-1B for kernel-team@lists.ubuntu.com; Thu, 31 Mar 2011 03:52:08 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1Q58vX-0005su-VC for ; Thu, 31 Mar 2011 03:52:07 +0000 Received: from 114-45-59-58.dynamic.hinet.net ([114.45.59.58] helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1Q58vX-00052B-3f for kernel-team@lists.ubuntu.com; Thu, 31 Mar 2011 03:52:07 +0000 From: Keng-Yu Lin To: kernel-team@lists.ubuntu.com Subject: [PATCH 05/11] UBUNTU: SAUCE: (drop after 2.6.39) Staging: rts_pstor: fix read past end of buffer Date: Thu, 31 Mar 2011 11:51:07 +0800 Message-Id: <1301543473-11146-6-git-send-email-keng-yu.lin@canonical.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1301543473-11146-1-git-send-email-keng-yu.lin@canonical.com> References: <1301543473-11146-1-git-send-email-keng-yu.lin@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Dan Carpenter We read one space past the end of the buffer because we add 1. Also I changed it to use ARRAY_SIZE() instead of manually calculating the size. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman BugLink: http://bugs.launchpad.net/bugs/698006 (cherry picked from commit 7e79f78b331632c1812ce9c07443550aa2b6c0fe) Signed-off-by: Keng-Yu Lin --- drivers/staging/rts_pstor/ms.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/staging/rts_pstor/ms.c b/drivers/staging/rts_pstor/ms.c index dd59931..a624f40 100644 --- a/drivers/staging/rts_pstor/ms.c +++ b/drivers/staging/rts_pstor/ms.c @@ -3361,7 +3361,7 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rtsx_chip *chip, u32 log_blk = (u16)(start_sector >> ms_card->block_shift); start_page = (u8)(start_sector & ms_card->page_off); - for (seg_no = 0; seg_no < sizeof(ms_start_idx)/2; seg_no++) { + for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1; seg_no++) { if (log_blk < ms_start_idx[seg_no+1]) break; }