[PATCH] coverity: i386: scsi_lib buffer overrun fix

The check in

627 BUG_ON(index > SG_MEMPOOL_NR);

with SG_MEMPOOL_NR defined in

32 #define SG_MEMPOOL_NR (sizeof(scsi_sg_pools)/sizeof(struct scsi_host_sg_pool))

was not sufficient.

sgp, set in

629 sgp = scsi_sg_pools + index;

is dereferenced in

630 mempool_free(sgl, sgp->pool);

Signed-off-by: Zaur Kambarov <[e-mail]>
Cc: <[e-mail]>
Cc: James Bottomley <[e-mail]>
Signed-off-by: Andrew Morton <[e-mail]>
Signed-off-by: Linus Torvalds <[e-mail]>

drivers/scsi/scsi_lib.c

···
 {
 	struct scsi_host_sg_pool *sgp;
 
-	BUG_ON(index > SG_MEMPOOL_NR);
+	BUG_ON(index >= SG_MEMPOOL_NR);
 
 	sgp = scsi_sg_pools + index;
 	mempool_free(sgl, sgp->pool);