diff options
| author | Dan Carpenter | 2015-03-12 18:24:31 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2015-03-24 15:31:24 +0100 |
| commit | 4bef52f377b6410a89fc580a8948033f613854f8 (patch) | |
| tree | 037515e1fa5cfe94d88646696a58317e1d136ac2 /drivers/staging/dgnc/dgnc_neo.c | |
| parent | stating: octeon-usb: cvmx_usb_initialize(): eliminate extra indentation (diff) | |
| download | kernel-qcow2-linux-4bef52f377b6410a89fc580a8948033f613854f8.tar.gz kernel-qcow2-linux-4bef52f377b6410a89fc580a8948033f613854f8.tar.xz kernel-qcow2-linux-4bef52f377b6410a89fc580a8948033f613854f8.zip | |
staging: dgnc: some off by one bugs
"dgnc_NumBoards" is the number of filled out elements in the
dgnc_Board[] array. "->nasync" and "->maxports" are the same value.
They are the number of channels in the ->channels[] array so these tests
should be ">=" instead of ">" so we avoid reading past the end of the
arrays.
I cleaned up the conditions in dgnc_mgmt_ioctl() a bit. There was a
work around for the off by one bug in the case where there were no
boards which is no longer needed. "channel" is unsigned so it can't be
negative.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/dgnc/dgnc_neo.c')
| -rw-r--r-- | drivers/staging/dgnc/dgnc_neo.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/staging/dgnc/dgnc_neo.c b/drivers/staging/dgnc/dgnc_neo.c index 41105be24229..f5a4d365115f 100644 --- a/drivers/staging/dgnc/dgnc_neo.c +++ b/drivers/staging/dgnc/dgnc_neo.c @@ -391,7 +391,7 @@ static inline void neo_parse_isr(struct dgnc_board *brd, uint port) if (!brd || brd->magic != DGNC_BOARD_MAGIC) return; - if (port > brd->maxports) + if (port >= brd->maxports) return; ch = brd->channels[port]; @@ -521,7 +521,7 @@ static inline void neo_parse_lsr(struct dgnc_board *brd, uint port) if (!brd || brd->magic != DGNC_BOARD_MAGIC) return; - if (port > brd->maxports) + if (port >= brd->maxports) return; ch = brd->channels[port]; @@ -1003,7 +1003,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd) */ /* Verify the port is in range. */ - if (port > brd->nasync) + if (port >= brd->nasync) continue; ch = brd->channels[port]; |