aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/macintosh/macio_asic.c
diff options
context:
space:
mode:
authorroel kluin <roel.kluin@gmail.com>2009-08-02 22:41:42 -0400
committerBenjamin Herrenschmidt <benh@kernel.crashing.org>2009-08-19 20:29:26 -0400
commitfb2881a7134576a6e95a63e3d2f34ea5629db4a1 (patch)
tree98ec36788b126a30f56fcac57196d4e29fe7e72f /drivers/macintosh/macio_asic.c
parent14ea58ad797e4e9b7be755aca0fd3925d0713ede (diff)
powerpc/macio: Don't the address of an array element before boundchecking
Check whether index is within bounds before grabbing the element. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Diffstat (limited to 'drivers/macintosh/macio_asic.c')
-rw-r--r--drivers/macintosh/macio_asic.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index a0f68386c12f..588a5b0bc4b5 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -294,10 +294,11 @@ static void macio_setup_interrupts(struct macio_dev *dev)
294 int i = 0, j = 0; 294 int i = 0, j = 0;
295 295
296 for (;;) { 296 for (;;) {
297 struct resource *res = &dev->interrupt[j]; 297 struct resource *res;
298 298
299 if (j >= MACIO_DEV_COUNT_IRQS) 299 if (j >= MACIO_DEV_COUNT_IRQS)
300 break; 300 break;
301 res = &dev->interrupt[j];
301 irq = irq_of_parse_and_map(np, i++); 302 irq = irq_of_parse_and_map(np, i++);
302 if (irq == NO_IRQ) 303 if (irq == NO_IRQ)
303 break; 304 break;
@@ -321,9 +322,10 @@ static void macio_setup_resources(struct macio_dev *dev,
321 int index; 322 int index;
322 323
323 for (index = 0; of_address_to_resource(np, index, &r) == 0; index++) { 324 for (index = 0; of_address_to_resource(np, index, &r) == 0; index++) {
324 struct resource *res = &dev->resource[index]; 325 struct resource *res;
325 if (index >= MACIO_DEV_COUNT_RESOURCES) 326 if (index >= MACIO_DEV_COUNT_RESOURCES)
326 break; 327 break;
328 res = &dev->resource[index];
327 *res = r; 329 *res = r;
328 res->name = dev_name(&dev->ofdev.dev); 330 res->name = dev_name(&dev->ofdev.dev);
329 331