android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

serial: jsm: some off by one bugs

Browse Source 
"brd->nasync" amd "brd->maxports" are the same.  They hold the number of
filled out channels in the brd->channels[] array.  These tests should
be ">=" instead of ">" so that we don't read one element past the end.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2015-03-17 12:17:28 +03:00 committed by Greg Kroah-Hartman
parent 136debf707
commit a666b54ada
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/tty/serial/jsm/jsm_cls.c
View File

@ -570,7 +570,7 @@ static inline void cls_parse_isr(struct jsm_board *brd, uint port)
* verified in the interrupt routine. * verified in the interrupt routine.
*/ */
if (port > brd->nasync) if (port >= brd->nasync)
return; return;
ch = brd->channels[port]; ch = brd->channels[port];

6
drivers/tty/serial/jsm/jsm_neo.c
View File

@ -724,7 +724,7 @@ static inline void neo_parse_isr(struct jsm_board *brd, u32 port)
if (!brd) if (!brd)
return; return;
if (port > brd->maxports) if (port >= brd->maxports)
return; return;
ch = brd->channels[port]; ch = brd->channels[port];
@ -840,7 +840,7 @@ static inline void neo_parse_lsr(struct jsm_board *brd, u32 port)
if (!brd) if (!brd)
return; return;
if (port > brd->maxports) if (port >= brd->maxports)
return; return;
ch = brd->channels[port]; ch = brd->channels[port];
@ -1180,7 +1180,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd)
*/ */
/* Verify the port is in range. */ /* Verify the port is in range. */
if (port > brd->nasync) if (port >= brd->nasync)
continue; continue;
ch = brd->channels[port]; ch = brd->channels[port];