Do not go beyond ARRAY_SIZE of info->shadow
Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
---
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index a6cbf7b..d395986 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -122,7 +122,7 @@ static DEFINE_SPINLOCK(blkif_io_lock);
static int get_id_from_freelist(struct blkfront_info *info)
{
unsigned long free = info->shadow_free;
- BUG_ON(free > BLK_RING_SIZE);
+ BUG_ON(free >= BLK_RING_SIZE);
info->shadow_free = info->shadow[free].req.id;
info->shadow[free].req.id = 0x0fffffee; /* debug */
return free;
Jeremy Fitzhardinge
2009-May-21 18:48 UTC
[PATCH] xen/blkfront: beyond ARRAY_SIZE of info->shadow
Roel Kluin wrote:> Do not go beyond ARRAY_SIZE of info->shadow > > Signed-off-by: Roel Kluin <roel.kluin at gmail.com> >Acked-by: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com> Jens, can you put this into a next-merge-window branch? Thanks, J> --- > diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c > index a6cbf7b..d395986 100644 > --- a/drivers/block/xen-blkfront.c > +++ b/drivers/block/xen-blkfront.c > @@ -122,7 +122,7 @@ static DEFINE_SPINLOCK(blkif_io_lock); > static int get_id_from_freelist(struct blkfront_info *info) > { > unsigned long free = info->shadow_free; > - BUG_ON(free > BLK_RING_SIZE); > + BUG_ON(free >= BLK_RING_SIZE); > info->shadow_free = info->shadow[free].req.id; > info->shadow[free].req.id = 0x0fffffee; /* debug */ > return free; > > _______________________________________________ > Virtualization mailing list > Virtualization at lists.linux-foundation.org > https://lists.linux-foundation.org/mailman/listinfo/virtualization > >
On Thu, May 21 2009, Jeremy Fitzhardinge wrote:> Roel Kluin wrote: >> Do not go beyond ARRAY_SIZE of info->shadow >> >> Signed-off-by: Roel Kluin <roel.kluin at gmail.com> >> > Acked-by: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com> > > Jens, can you put this into a next-merge-window branch?Sure, will do. -- Jens Axboe