diff options
| author | KAMBAROV, ZAUR <[email protected]> | 2005-06-28 20:45:06 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2005-06-28 21:20:33 -0700 |
| commit | a77e3362a224212d9d3b9e6fdec44df2eef6cf92 (patch) | |
| tree | 5ebf2ebc3df91674101b6a5591753ee1d999abea /net/lapb/lapb_timer.c | |
| parent | a8f5034540195307362d071a8b387226b410469f (diff) | |
[PATCH] coverity: i386: scsi_lib buffer overrun fix
The check in
627 BUG_ON(index > SG_MEMPOOL_NR);
with SG_MEMPOOL_NR defined in
32 #define SG_MEMPOOL_NR (sizeof(scsi_sg_pools)/sizeof(struct scsi_host_sg_pool))
was not sufficient.
sgp, set in
629 sgp = scsi_sg_pools + index;
is dereferenced in
630 mempool_free(sgl, sgp->pool);
Signed-off-by: Zaur Kambarov <[email protected]>
Cc: <[email protected]>
Cc: James Bottomley <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions