From: KAMBAROV, ZAUR <kambarov@berkeley.edu>
Date: Wed, 29 Jun 2005 03:45:06 +0000 (-0700)
Subject: [PATCH] coverity: i386: scsi_lib buffer overrun fix
X-Git-Tag: v2.6.13-rc1~20
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a77e3362a224212d9d3b9e6fdec44df2eef6cf92;p=pandora-kernel.git

[PATCH] coverity: i386: scsi_lib buffer overrun fix

The check in

627  		BUG_ON(index > SG_MEMPOOL_NR);

with SG_MEMPOOL_NR defined in

32   	#define SG_MEMPOOL_NR		(sizeof(scsi_sg_pools)/sizeof(struct scsi_host_sg_pool))

was not sufficient.

sgp, set in

629  		sgp = scsi_sg_pools + index;

is dereferenced in

630  		mempool_free(sgl, sgp->pool);

Signed-off-by: Zaur Kambarov <zkambarov@coverity.com>
Cc: <linux-scsi@vger.kernel.org>
Cc: James Bottomley <James.Bottomley@steeleye.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---

Reading git-diff-tree failed