[SCSI] csiostor: off by one error
authorDan Carpenter <dan.carpenter@oracle.com>
Sat, 16 Mar 2013 10:07:56 +0000 (13:07 +0300)
committerJames Bottomley <JBottomley@Parallels.com>
Thu, 2 May 2013 14:37:10 +0000 (07:37 -0700)
We need to store PROTO_ERR_IMPL_LOGO (26) things here, but the
first element isn't used so the array should have 27 elements.
This matches fwevt_to_rnevt[] which has 27 elements.

The patch solves a Smatch static checker warning on my system:
drivers/scsi/csiostor/csio_rnode.c:880 csio_rnode_fwevt_handler()
error: buffer overflow '(rn)->stats.n_evt_fw' 26 <= 26

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Naresh Kumar Inna <naresh@chelsio.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
drivers/scsi/csiostor/csio_lnode.h
drivers/scsi/csiostor/csio_rnode.h

index 0f9c04175b11d4894f34157bf8177d6956c2f9c7..372a67d122d38fc161743c105db229c534d26a89 100644 (file)
@@ -114,7 +114,7 @@ struct csio_lnode_stats {
        uint32_t        n_rnode_match;  /* matched rnode */
        uint32_t        n_dev_loss_tmo; /* Device loss timeout */
        uint32_t        n_fdmi_err;     /* fdmi err */
-       uint32_t        n_evt_fw[PROTO_ERR_IMPL_LOGO];  /* fw events */
+       uint32_t        n_evt_fw[PROTO_ERR_IMPL_LOGO + 1];      /* fw events */
        enum csio_ln_ev n_evt_sm[CSIO_LNE_MAX_EVENT];   /* State m/c events */
        uint32_t        n_rnode_alloc;  /* rnode allocated */
        uint32_t        n_rnode_free;   /* rnode freed */
index 65940096a80d8426eb438392bf544ecee1d5a1e1..43343422122202c9614d4b76539c5a5d20e2fab6 100644 (file)
@@ -63,7 +63,7 @@ struct csio_rnode_stats {
        uint32_t        n_err_nomem;    /* error nomem */
        uint32_t        n_evt_unexp;    /* unexpected event */
        uint32_t        n_evt_drop;     /* unexpected event */
-       uint32_t        n_evt_fw[PROTO_ERR_IMPL_LOGO];  /* fw events */
+       uint32_t        n_evt_fw[PROTO_ERR_IMPL_LOGO + 1];      /* fw events */
        enum csio_rn_ev n_evt_sm[CSIO_RNFE_MAX_EVENT];  /* State m/c events */
        uint32_t        n_lun_rst;      /* Number of resets of
                                         * of LUNs under this