diff mbox

[SCSI] sym53c8xx_2: iterator underflow in sym_getsync()

Message ID 20180125141340.GA7299@mwanda (mailing list archive)
State Accepted
Headers show

Commit Message

Dan Carpenter Jan. 25, 2018, 2:13 p.m. UTC 
We wanted to exit the loop with "div" set to zero, but instead, if we
don't hit the break then "div" is -1 when we finish the loop.  It leads
to an array underflow a few lines later.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Johannes Thumshirn Jan. 29, 2018, 2:51 p.m. UTC | #1 
Looks good,
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Martin K. Petersen Jan. 31, 2018, 2:29 a.m. UTC | #2 
Dan,

> We wanted to exit the loop with "div" set to zero, but instead, if we
> don't hit the break then "div" is -1 when we finish the loop.  It
> leads to an array underflow a few lines later.

Applied to 4.16/scsi-fixes, thanks!
diff mbox

Patch

diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index ca360daa6a25..378af306fda1 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -536,7 +536,7 @@  sym_getsync(struct sym_hcb *np, u_char dt, u_char sfac, u_char *divp, u_char *fa
 	 *  Look for the greatest clock divisor that allows an 
 	 *  input speed faster than the period.
 	 */
-	while (div-- > 0)
+	while (--div > 0)
 		if (kpc >= (div_10M[div] << 2)) break;
 
 	/*