Fix off-by-one error where sdev->id is allowed to equal MYRB_MAX_TARGETS
(16), leading to out-of-bounds array access. When sdev->id is 16 and
channel is 2, err_table_offset becomes 48, accessing array index 48
in a 48-element array (indices 0-47).
Change the boundary check from > to >= to properly reject invalid
target IDs.
Cc: stable@vger.kernel.org
Fixes: 081ff398c56c ("scsi: myrb: Add Mylex RAID controller (block interface)")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
drivers/scsi/myrb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c
index 591ba70a0579..54d89d1643de 100644
--- a/drivers/scsi/myrb.c
+++ b/drivers/scsi/myrb.c
@@ -1669,7 +1669,7 @@ static int myrb_pdev_sdev_init(struct scsi_device *sdev)
struct myrb_pdev_state *pdev_info;
unsigned short status;
- if (sdev->id > MYRB_MAX_TARGETS)
+ if (sdev->id >= MYRB_MAX_TARGETS)
return -ENXIO;
pdev_info = kzalloc_obj(*pdev_info);
--
2.25.1