The loop in __ipr_format_res_path() reads res_path[i] before checking
i against IPR_RES_PATH_BYTES, so an adapter-supplied resource path
without a 0xff terminator in its 8 bytes causes a read one byte past
the array.
Move the index check before the element access so the loop stops at
the array boundary.
Fixes: 3e7ebdfa58dd ("[SCSI] ipr: update the configuration table code for the next generation chip")
Cc: stable@vger.kernel.org
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
drivers/scsi/ipr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index dbd58a7e7bc1..3cb8fb02d706 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -1217,7 +1217,7 @@ static char *__ipr_format_res_path(u8 *res_path, char *buffer, int len)
*p = '\0';
p += scnprintf(p, buffer + len - p, "%02X", res_path[0]);
- for (i = 1; res_path[i] != 0xff && i < IPR_RES_PATH_BYTES; i++)
+ for (i = 1; i < IPR_RES_PATH_BYTES && res_path[i] != 0xff; i++)
p += scnprintf(p, buffer + len - p, "-%02X", res_path[i]);
return buffer;
--
2.43.0