From: Dan Carpenter <error27@gmail.com>
Date: Tue, 1 Jun 2010 10:17:48 +0000 (+0200)
Subject: cciss: call BUG() earlier
X-Git-Tag: v2.6.35-rc2~12^2~7
X-Git-Url: http://pileus.org/git/?a=commitdiff_plain;h=713b686494a577b3c4f4f9f585a4705fc30d51c2;hp=099c5c310e9744bd0654881bb55c137051228e56;p=~andy%2Flinux

cciss: call BUG() earlier

I moved the range check after the increment.  The current code would
write past the end of the array once before calling BUG().

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
---

diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index e1d0e2cfec7..3381505c8a6 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -188,11 +188,11 @@ scsi_cmd_free(ctlr_info_t *h, CommandList_struct *cmd)
 
 	sa = h->scsi_ctlr;
 	stk = &sa->cmd_stack; 
+	stk->top++;
 	if (stk->top >= CMD_STACK_SIZE) {
 		printk("cciss: scsi_cmd_free called too many times.\n");
 		BUG();
 	}
-	stk->top++;
 	stk->elem[stk->top] = (struct cciss_scsi_cmd_stack_elem_t *) cmd;
 }