>>>>> "Brian" == Brian King <brking@xxxxxxxxxxxxxxxxxx> writes: Brian> Fixes another signed / unsigned array indexing bug in the ipr Brian> driver. Currently, when hrrq_index wraps, it becomes a negative Brian> number. We do the modulo, but still have a negative number, so we Brian> end up indexing backwards in the array. Given where the hrrq Brian> array is located in memory, we probably won't actually reference Brian> memory we don't own, but nonetheless ipr is still looking at data Brian> within struct ipr_ioa_cfg and interpreting it as struct Brian> ipr_hrr_queue data, so bad things could certainly happen. Reviewed-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx> -- Martin K. Petersen Oracle Linux Engineering -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
