diff options
author | roel kluin <roel.kluin@gmail.com> | 2009-08-02 22:41:42 -0400 |
---|---|---|
committer | Benjamin Herrenschmidt <benh@kernel.crashing.org> | 2009-08-19 20:29:26 -0400 |
commit | fb2881a7134576a6e95a63e3d2f34ea5629db4a1 (patch) | |
tree | 98ec36788b126a30f56fcac57196d4e29fe7e72f /drivers/macintosh | |
parent | 14ea58ad797e4e9b7be755aca0fd3925d0713ede (diff) |
powerpc/macio: Don't the address of an array element before boundchecking
Check whether index is within bounds before grabbing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Diffstat (limited to 'drivers/macintosh')
-rw-r--r-- | drivers/macintosh/macio_asic.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c index a0f68386c12f..588a5b0bc4b5 100644 --- a/drivers/macintosh/macio_asic.c +++ b/drivers/macintosh/macio_asic.c | |||
@@ -294,10 +294,11 @@ static void macio_setup_interrupts(struct macio_dev *dev) | |||
294 | int i = 0, j = 0; | 294 | int i = 0, j = 0; |
295 | 295 | ||
296 | for (;;) { | 296 | for (;;) { |
297 | struct resource *res = &dev->interrupt[j]; | 297 | struct resource *res; |
298 | 298 | ||
299 | if (j >= MACIO_DEV_COUNT_IRQS) | 299 | if (j >= MACIO_DEV_COUNT_IRQS) |
300 | break; | 300 | break; |
301 | res = &dev->interrupt[j]; | ||
301 | irq = irq_of_parse_and_map(np, i++); | 302 | irq = irq_of_parse_and_map(np, i++); |
302 | if (irq == NO_IRQ) | 303 | if (irq == NO_IRQ) |
303 | break; | 304 | break; |
@@ -321,9 +322,10 @@ static void macio_setup_resources(struct macio_dev *dev, | |||
321 | int index; | 322 | int index; |
322 | 323 | ||
323 | for (index = 0; of_address_to_resource(np, index, &r) == 0; index++) { | 324 | for (index = 0; of_address_to_resource(np, index, &r) == 0; index++) { |
324 | struct resource *res = &dev->resource[index]; | 325 | struct resource *res; |
325 | if (index >= MACIO_DEV_COUNT_RESOURCES) | 326 | if (index >= MACIO_DEV_COUNT_RESOURCES) |
326 | break; | 327 | break; |
328 | res = &dev->resource[index]; | ||
327 | *res = r; | 329 | *res = r; |
328 | res->name = dev_name(&dev->ofdev.dev); | 330 | res->name = dev_name(&dev->ofdev.dev); |
329 | 331 | ||