mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
serial: jsm: some off by one bugs
"brd->nasync" amd "brd->maxports" are the same. They hold the number of filled out channels in the brd->channels[] array. These tests should be ">=" instead of ">" so that we don't read one element past the end. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
136debf707
commit
a666b54ada
2 changed files with 4 additions and 4 deletions
|
@ -570,7 +570,7 @@ static inline void cls_parse_isr(struct jsm_board *brd, uint port)
|
|||
* verified in the interrupt routine.
|
||||
*/
|
||||
|
||||
if (port > brd->nasync)
|
||||
if (port >= brd->nasync)
|
||||
return;
|
||||
|
||||
ch = brd->channels[port];
|
||||
|
|
|
@ -724,7 +724,7 @@ static inline void neo_parse_isr(struct jsm_board *brd, u32 port)
|
|||
if (!brd)
|
||||
return;
|
||||
|
||||
if (port > brd->maxports)
|
||||
if (port >= brd->maxports)
|
||||
return;
|
||||
|
||||
ch = brd->channels[port];
|
||||
|
@ -840,7 +840,7 @@ static inline void neo_parse_lsr(struct jsm_board *brd, u32 port)
|
|||
if (!brd)
|
||||
return;
|
||||
|
||||
if (port > brd->maxports)
|
||||
if (port >= brd->maxports)
|
||||
return;
|
||||
|
||||
ch = brd->channels[port];
|
||||
|
@ -1180,7 +1180,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd)
|
|||
*/
|
||||
|
||||
/* Verify the port is in range. */
|
||||
if (port > brd->nasync)
|
||||
if (port >= brd->nasync)
|
||||
continue;
|
||||
|
||||
ch = brd->channels[port];
|
||||
|
|
Loading…
Reference in a new issue