Commit f25f84b7 authored by Daniel Verkamp's avatar Daniel Verkamp Committed by Jim Harris
Browse files

scsi: fix off-by-one error in spdk_scsi_dev_get_lun() 



lun_id could potentially overflow the dev->lun array bounds if it was
equal to dev->maxlun, which is actually the maximum lun array index plus
one, not the maximum valid LUN index.

Change-Id: I5662c6f6fa634a7dd755c9bfc1a24d3c4cabe7ea
Reported-by: default avatarDariusz Stojaczyk <dariuszx.stojaczyk@intel.com>
Signed-off-by: default avatarDaniel Verkamp <daniel.verkamp@intel.com>
Reviewed-on: https://review.gerrithub.io/369074


Tested-by: default avatarSPDK Automated Test System <sys_sgsw@intel.com>
Reviewed-by: default avatarBen Walker <benjamin.walker@intel.com>
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
parent e2f42584

lib/scsi/dev.c

+1 −1
Original line number Diff line number Diff line
@@ -331,7 +331,7 @@ spdk_scsi_dev_get_max_lun(const struct spdk_scsi_dev *dev) 
struct spdk_scsi_lun *

spdk_scsi_dev_get_lun(struct spdk_scsi_dev *dev, int lun_id)

{

	if (lun_id < 0 || lun_id > dev->maxlun) {

	if (lun_id < 0 || lun_id >= dev->maxlun) {

		return NULL;

	}