mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 01:41:39 +00:00
serial: jsm: some off by one bugs
"brd->nasync" amd "brd->maxports" are the same. They hold the number of filled out channels in the brd->channels[] array. These tests should be ">=" instead of ">" so that we don't read one element past the end. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
136debf707
commit
a666b54ada
2 changed files with 4 additions and 4 deletions
|
@ -570,7 +570,7 @@ static inline void cls_parse_isr(struct jsm_board *brd, uint port)
|
||||||
* verified in the interrupt routine.
|
* verified in the interrupt routine.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
if (port > brd->nasync)
|
if (port >= brd->nasync)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
ch = brd->channels[port];
|
ch = brd->channels[port];
|
||||||
|
|
|
@ -724,7 +724,7 @@ static inline void neo_parse_isr(struct jsm_board *brd, u32 port)
|
||||||
if (!brd)
|
if (!brd)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
if (port > brd->maxports)
|
if (port >= brd->maxports)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
ch = brd->channels[port];
|
ch = brd->channels[port];
|
||||||
|
@ -840,7 +840,7 @@ static inline void neo_parse_lsr(struct jsm_board *brd, u32 port)
|
||||||
if (!brd)
|
if (!brd)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
if (port > brd->maxports)
|
if (port >= brd->maxports)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
ch = brd->channels[port];
|
ch = brd->channels[port];
|
||||||
|
@ -1180,7 +1180,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd)
|
||||||
*/
|
*/
|
||||||
|
|
||||||
/* Verify the port is in range. */
|
/* Verify the port is in range. */
|
||||||
if (port > brd->nasync)
|
if (port >= brd->nasync)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
ch = brd->channels[port];
|
ch = brd->channels[port];
|
||||||
|
|
Loading…
Reference in a new issue