Re: [PATCH v3 2/5] scsi: aic94xx: validate the EDB index in asd_get_response_tasklet()

[James Bottomley]

First a meta question: the aic94xx is about 20 years old today ... have
you actually tested this on real hardware?

On Thu, 2026-10-15 at 18:17 +0900, Yehyeong Lee wrote:
> asd_get_response_tasklet() takes the empty data buffer index out of
> the done list status block the sequencer wrote, with the same
> arithmetic
> escb_tasklet_complete() uses on its own copy:
> 
> 	int  edb_id = ((resp_sb->flags & 0x70) >> 4)-1;
> 
> The extracted field is three bits, so the subtraction yields -1
> through 6, and the function indexes seq->edb_arr[] with it without
> looking:

These are the sequencer response flags ... is there any evidence of the
sequencer ever setting these three bits to a zero value?

[...]
> +	if (edb_id < 0 || edb_id >= ASD_EDBS_PER_SCB) {

Why the second comparison?  As you say the value could only be -1..6
and ASD_EDBS_PER_SCB is defined to 7.

Regards,

James