svn commit: r271354 - head/sys/cam/ctl

[Alexander Motin]

Author: mav
Date: Wed Sep 10 06:35:00 2014
New Revision: 271354
URL: http://svnweb.freebsd.org/changeset/base/271354

Log:
  Fix couple off-by-one range check errors, reported by Coverity.
  
  CID:		1007837

Modified:
  head/sys/cam/ctl/ctl.c

Modified: head/sys/cam/ctl/ctl.c
==============================================================================
--- head/sys/cam/ctl/ctl.c	Wed Sep 10 06:29:31 2014	(r271353)
+++ head/sys/cam/ctl/ctl.c	Wed Sep 10 06:35:00 2014	(r271354)
@@ -2543,7 +2543,7 @@ ctl_ioctl(struct cdev *dev, u_long cmd, 
 
 		mtx_lock(&softc->ctl_lock);
 		if (((ooa_hdr->flags & CTL_OOA_FLAG_ALL_LUNS) == 0)
-		 && ((ooa_hdr->lun_num > CTL_MAX_LUNS)
+		 && ((ooa_hdr->lun_num >= CTL_MAX_LUNS)
 		  || (softc->ctl_luns[ooa_hdr->lun_num] == NULL))) {
 			mtx_unlock(&softc->ctl_lock);
 			free(entries, M_CTL);
@@ -2738,7 +2738,7 @@ ctl_ioctl(struct cdev *dev, u_long cmd, 
 #ifdef CTL_IO_DELAY
 		mtx_lock(&softc->ctl_lock);
 
-		if ((delay_info->lun_id > CTL_MAX_LUNS)
+		if ((delay_info->lun_id >= CTL_MAX_LUNS)
 		 || (softc->ctl_luns[delay_info->lun_id] == NULL)) {
 			delay_info->status = CTL_DELAY_STATUS_INVALID_LUN;
 		} else {