unsigned req->data_len cannot be negative, and fix typo
Signed-off-by: Roel Kluin <roel.kluin@xxxxxxxxx>
---
Sorry, I just found out there were more similar issues, please
ignore previous patch.
I am not sure whether this is what was intended, please review.
Also I am unable to respond for a few weeks.
diff --git a/drivers/scsi/libsas/sas_host_smp.c b/drivers/scsi/libsas/sas_host_smp.c
index 16f9312..6eb0779 100644
--- a/drivers/scsi/libsas/sas_host_smp.c
+++ b/drivers/scsi/libsas/sas_host_smp.c
@@ -199,12 +199,12 @@ int sas_smp_host_handler(struct Scsi_Host *shost, struct request *req,
break;
case SMP_DISCOVER:
- req->data_len =- 16;
- if (req->data_len < 0) {
+ if (req->data_len < 15) {
req->data_len = 0;
error = -EINVAL;
goto out;
}
+ req->data_len -= 16;
resp_data_len -= 56;
sas_host_smp_discover(sas_ha, resp_data, req_data[9]);
break;
@@ -215,12 +215,12 @@ int sas_smp_host_handler(struct Scsi_Host *shost, struct request *req,
break;
case SMP_REPORT_PHY_SATA:
- req->data_len =- 16;
- if (req->data_len < 0) {
+ if (req->data_len < 15) {
req->data_len = 0;
error = -EINVAL;
goto out;
}
+ req->data_len -= 16;
resp_data_len -= 60;
sas_report_phy_sata(sas_ha, resp_data, req_data[9]);
break;
@@ -238,12 +238,12 @@ int sas_smp_host_handler(struct Scsi_Host *shost, struct request *req,
break;
case SMP_PHY_CONTROL:
- req->data_len =- 44;
- if (req->data_len < 0) {
+ if (req->data_len < 43) {
req->data_len = 0;
error = -EINVAL;
goto out;
}
+ req->data_len -= 44;
resp_data_len -= 8;
sas_phy_control(sas_ha, req_data[9], req_data[10],
req_data[32] >> 4, req_data[33] >> 4,
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
