scsi: fix off-by-one LUN check in scsi_scan_host_selected()
authorMark Knibbs <markk@clara.co.uk>
Thu, 9 Oct 2014 11:39:48 +0000 (12:39 +0100)
committerChristoph Hellwig <hch@lst.de>
Wed, 12 Nov 2014 10:15:53 +0000 (11:15 +0100)
The Scsi_Host structure max_lun field is the maximum allowed LUN plus 1. So
a LUN value is invalid if >= max_lun.

Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/scsi/scsi_scan.c

index 619e68d015aa05c677937c2a4fb48bffb4c27dc0..b1aa1646012a6856cb512142552250f174f191f2 100644 (file)
@@ -1727,7 +1727,7 @@ int scsi_scan_host_selected(struct Scsi_Host *shost, unsigned int channel,
 
        if (((channel != SCAN_WILD_CARD) && (channel > shost->max_channel)) ||
            ((id != SCAN_WILD_CARD) && (id >= shost->max_id)) ||
-           ((lun != SCAN_WILD_CARD) && (lun > shost->max_lun)))
+           ((lun != SCAN_WILD_CARD) && (lun >= shost->max_lun)))
                return -EINVAL;
 
        mutex_lock(&shost->scan_mutex);