[PATCH] scsi: advansys: Fix invalid comparison in AdvBuildCarrierFreelist

[Roman Demidov]

The loop index i takes values from 0 to carr_num - 1 therefore
the comparison i == carr_num is always false. The assignment
next_offset = ~0 must occur for the last element of the list,
its index is carr_num - 1.

In the adv_get_next_carrier() function, the last element of the
list is determined by the value next_vpa = ~0 or next_vpa = 0.
If adv_get_next_carrier() is called with the last element of the
list as an argument, instead of returning NULL, adv_get_carrier()
will be called with an invalid offset. The resulting address is
outside the bounds of the allocated memory, after which
carrp->next_vpa is written, leading to memory corruption.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 98b96a7d99c8 ("advansys: Use DMA-API for carrier buffer")
Signed-off-by: Roman Demidov <roman.demidov.nn@xxxxxxxxx>
---
 drivers/scsi/advansys.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 5cdbf2bdb13d..95a227420b28 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -4169,7 +4169,7 @@ static void AdvBuildCarrierFreelist(struct adv_dvc_var *adv_dvc)
 		adv_dvc->carrier[i].carr_va = cpu_to_le32(carr_offset);
 		adv_dvc->carrier[i].areq_vpa = 0;
 		next_offset = carr_offset + sizeof(ADV_CARR_T);
-		if (i == carr_num)
+		if (i == carr_num - 1)
 			next_offset = ~0;
 		adv_dvc->carrier[i].next_vpa = cpu_to_le32(next_offset);
 	}
-- 
2.53.0