Off-by-one LUN validation in scsi_scan_host_selected()?

[Mark Knibbs]

Hi,

In drivers/scsi_scsi_scan.c, we have:

int scsi_scan_host_selected(struct Scsi_Host *shost, unsigned int channel,
unsigned int id, u64 lun, int rescan)
...
if (((channel != SCAN_WILD_CARD) && (channel > shost->max_channel)) ||
((id != SCAN_WILD_CARD) && (id >= shost->max_id)) ||
((lun != SCAN_WILD_CARD) && (lun > shost->max_lun)))
return -EINVAL;
...

The max_lun field of the Scsi_Host structure (see include/scsi/scsi_host.h)
seems to be defined as the actual maximum LUN plus 1:
* These three parameters can be used to allow for wide scsi,
* and for host adapters that support multiple busses
* The first two should be set to 1 more than the actual max id
* or lun (e.g. 8 for SCSI parallel systems).
*/
unsigned int max_channel;
unsigned int max_id;
u64 max_lun;

[The comment has a typo; it refers to the max_id and max_lun fields as the
first two, but they are the last two.]

Shouldn't the LUN check in scsi_scan_host_selected() be
(lun >= shost->max_lun)?


Mark
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

[Christoph Hellwig]

Post by Mark Knibbs
Shouldn't the LUN check in scsi_scan_host_selected() be
(lun >= shost->max_lun)?

Seems so. Can you send a patch for it?

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html