aboutsummaryrefslogtreecommitdiff
path: root/drivers/target/loopback
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2011-04-02 14:32:47 -0700
committerNicholas Bellinger <nab@linux-iscsi.org>2011-07-22 09:37:46 +0000
commit12f09ccb4612734a53e47ed5302e0479c10a50f8 (patch)
tree6bbd52b7ac29fd768ccc12eca076a188a0eb07cf /drivers/target/loopback
parent21bca31c9678edda8eb1dc823be00d190965c53b (diff)
downloadvexpress-lsk-12f09ccb4612734a53e47ed5302e0479c10a50f8.tar.gz
loopback: off by one in tcm_loop_make_naa_tpg()
This is an off by one 'tgpt' check in tcm_loop_make_naa_tpg() that could result in memory corruption. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Nicholas A. Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target/loopback')
-rw-r--r--drivers/target/loopback/tcm_loop.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index c2937b2035d..083d6c51f05 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -1205,7 +1205,7 @@ struct se_portal_group *tcm_loop_make_naa_tpg(
tpgt_str += 5; /* Skip ahead of "tpgt_" */
tpgt = (unsigned short int) simple_strtoul(tpgt_str, &end_ptr, 0);
- if (tpgt > TL_TPGS_PER_HBA) {
+ if (tpgt >= TL_TPGS_PER_HBA) {
printk(KERN_ERR "Passed tpgt: %hu exceeds TL_TPGS_PER_HBA:"
" %u\n", tpgt, TL_TPGS_PER_HBA);
return ERR_PTR(-EINVAL);