Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2471ec58 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: rts5139: a couple off by one fixes 



Inside the array we check ms_start_idx[seg_no + 1] so on the last round
through we end up going past the end of the array.

Also if we don't break out of the loop early then we are beyond the end
of the array there as well.  With this change, if we don't find what we
are looking for, we end on the last element of the array.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent fc44de00

drivers/staging/rts5139/ms.c

+3 −2
Original line number Diff line number Diff line
@@ -3864,7 +3864,7 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rts51x_chip *chip, 
	log_blk = (u16) (start_sector >> ms_card->block_shift);

	start_page = (u8) (start_sector & ms_card->page_off);



	for (seg_no = 0; seg_no < sizeof(ms_start_idx) / 2; seg_no++) {

	for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1; seg_no++) {

		if (log_blk < ms_start_idx[seg_no + 1])

			break;

	}
@@ -4020,7 +4020,8 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rts51x_chip *chip, 


		log_blk++;



		for (seg_no = 0; seg_no < sizeof(ms_start_idx) / 2; seg_no++) {

		for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1;

				seg_no++) {

			if (log_blk < ms_start_idx[seg_no + 1])

				break;

		}