From: Stephen Cameron <stephenmcameron@gmail.com>
Date: Fri, 23 Jan 2015 22:44:14 +0000 (-0600)
Subject: hpsa: guard against overflowing raid map array
X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=07543e0c05de177f2e9612ae7756e904b329379c;p=deliverable%2Flinux.git

hpsa: guard against overflowing raid map array

In the code that translates logical drive LBAs to physical
drive LBAs if we overflow the raid map disk data array we
will get the wrong answers.  We do not expect that to happen,
but best to be on the safe side and guard against it anyway.

Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
---

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index afd192d2d27d..03fae8af23ec 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3921,6 +3921,9 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
 		return IO_ACCEL_INELIGIBLE;
 	}
 
+	if (unlikely(map_index >= RAID_MAP_MAX_ENTRIES))
+		return IO_ACCEL_INELIGIBLE;
+
 	c->phys_disk = dev->phys_disk[map_index];
 
 	disk_handle = dd[map_index].ioaccel_handle;