diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-03-17 05:17:28 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-03-26 18:00:36 -0400 |
| commit | a666b54adabc7dd40d754671a26996e6c985ae1b (patch) | |
| tree | eafdaa1b060e9455efeda541e5feb783f996d764 /drivers/tty/serial/jsm/jsm_neo.c | |
| parent | 136debf707d2b3cd8e74d0fff8e29d11a78bf5c2 (diff) | |
serial: jsm: some off by one bugs
"brd->nasync" amd "brd->maxports" are the same. They hold the number of
filled out channels in the brd->channels[] array. These tests should
be ">=" instead of ">" so that we don't read one element past the end.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty/serial/jsm/jsm_neo.c')
| -rw-r--r-- | drivers/tty/serial/jsm/jsm_neo.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/tty/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c index 7291c2117daa..932b2accd06f 100644 --- a/drivers/tty/serial/jsm/jsm_neo.c +++ b/drivers/tty/serial/jsm/jsm_neo.c | |||
| @@ -724,7 +724,7 @@ static inline void neo_parse_isr(struct jsm_board *brd, u32 port) | |||
| 724 | if (!brd) | 724 | if (!brd) |
| 725 | return; | 725 | return; |
| 726 | 726 | ||
| 727 | if (port > brd->maxports) | 727 | if (port >= brd->maxports) |
| 728 | return; | 728 | return; |
| 729 | 729 | ||
| 730 | ch = brd->channels[port]; | 730 | ch = brd->channels[port]; |
| @@ -840,7 +840,7 @@ static inline void neo_parse_lsr(struct jsm_board *brd, u32 port) | |||
| 840 | if (!brd) | 840 | if (!brd) |
| 841 | return; | 841 | return; |
| 842 | 842 | ||
| 843 | if (port > brd->maxports) | 843 | if (port >= brd->maxports) |
| 844 | return; | 844 | return; |
| 845 | 845 | ||
| 846 | ch = brd->channels[port]; | 846 | ch = brd->channels[port]; |
| @@ -1180,7 +1180,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd) | |||
| 1180 | */ | 1180 | */ |
| 1181 | 1181 | ||
| 1182 | /* Verify the port is in range. */ | 1182 | /* Verify the port is in range. */ |
| 1183 | if (port > brd->nasync) | 1183 | if (port >= brd->nasync) |
| 1184 | continue; | 1184 | continue; |
| 1185 | 1185 | ||
| 1186 | ch = brd->channels[port]; | 1186 | ch = brd->channels[port]; |