From: Matthew Wilcox <matthew@wil.cx>
Date: Fri, 21 Mar 2008 15:15:03 +0000 (+0000)
Subject: SCSI advansys: Fix bug in AdvLoadMicrocode
X-Git-Tag: v2.6.24.4~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=868145d87bd058f271921c69519d4e2311171d28;p=thirdparty%2Fkernel%2Fstable.git

SCSI advansys: Fix bug in AdvLoadMicrocode

commit: 951b62c11e86acf8c55d9828aa8c921575023c29

buf[i] can be up to 0xfd, so doubling it and assigning the result to an
unsigned char truncates the value.  Just use an unsigned int instead;
it's only a temporary.

Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index ce8ccb04540d8..f40417b9517e6 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -6439,7 +6439,7 @@ static int AdvLoadMicrocode(AdvPortAddr iop_base, unsigned char *buf, int size,
 			i += 2;
 			len += 2;
 		} else {
-			unsigned char off = buf[i] * 2;
+			unsigned int off = buf[i] * 2;
 			unsigned short word = (buf[off + 1] << 8) | buf[off];
 			AdvWriteWordAutoIncLram(iop_base, word);
 			len += 2;