cciss: call BUG() earlier
authorDan Carpenter <error27@gmail.com>
Tue, 1 Jun 2010 10:17:48 +0000 (12:17 +0200)
committerJens Axboe <jaxboe@fusionio.com>
Tue, 1 Jun 2010 10:17:48 +0000 (12:17 +0200)
I moved the range check after the increment.  The current code would
write past the end of the array once before calling BUG().

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
drivers/block/cciss_scsi.c

index e1d0e2c..3381505 100644 (file)
@@ -188,11 +188,11 @@ scsi_cmd_free(ctlr_info_t *h, CommandList_struct *cmd)
 
        sa = h->scsi_ctlr;
        stk = &sa->cmd_stack; 
+       stk->top++;
        if (stk->top >= CMD_STACK_SIZE) {
                printk("cciss: scsi_cmd_free called too many times.\n");
                BUG();
        }
-       stk->top++;
        stk->elem[stk->top] = (struct cciss_scsi_cmd_stack_elem_t *) cmd;
 }