Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 713b6864 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jens Axboe
Browse files

cciss: call BUG() earlier 



I moved the range check after the increment.  The current code would
write past the end of the array once before calling BUG().

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarJens Axboe <jaxboe@fusionio.com>
parent 099c5c31

drivers/block/cciss_scsi.c

+1 −1
Original line number Diff line number Diff line
@@ -188,11 +188,11 @@ scsi_cmd_free(ctlr_info_t *h, CommandList_struct *cmd) 


	sa = h->scsi_ctlr;

	stk = &sa->cmd_stack; 

	stk->top++;

	if (stk->top >= CMD_STACK_SIZE) {

		printk("cciss: scsi_cmd_free called too many times.\n");

		BUG();

	}

	stk->top++;

	stk->elem[stk->top] = (struct cciss_scsi_cmd_stack_elem_t *) cmd;

}