[PATCH] ips driver 1/4: fix struct length and remove dead code

David Jeffery · Linus Torvalds · commit 9d252c210314 · 2003-02-05T18:23:29.000-08:00
This small patch fixes the length of the IPS_ENQ
struct.  It was too short which can cause the adapter
to write beyond the the end of the struct during
driver initialization and corrupt part of memory.
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
@@ -1155,13 +1155,6 @@ ips_queue(Scsi_Cmnd *SC, void (*done) (Scsi_Cmnd *)) {
 
    ips_next(ha, IPS_INTR_IORL);
    
-   /* If We were using the CD Boot Flash Buffer, Restore the Old Values */
-   if ( ips_FlashData == ha->ioctl_data ) {                               
-      ha->ioctl_data = ha->flash_data;                           
-      ha->ioctl_order = ha->flash_order;                          
-      ha->ioctl_datasize = ha->flash_datasize;                       
-      ips_FlashDataInUse = 0;                                             
-   }
    return (0);
 }
 
diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
@@ -714,7 +714,7 @@ typedef struct {
    uint16_t usConfigUpdateCount;
    uint8_t  ucBlkFlag;
    uint8_t  reserved;
-   uint16_t usAddrDeadDisk[IPS_MAX_CHANNELS * IPS_MAX_TARGETS];
+   uint16_t usAddrDeadDisk[IPS_MAX_CHANNELS * (IPS_MAX_TARGETS + 1)];
 } IPS_ENQ, *PIPS_ENQ;
 
 typedef struct {
