projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: a12bb44)
Overrun in drivers/char/rio/riocmd.c
authorEric Sesterhenn / Snakebyte <snakebyte@gmx.de>
Fri, 11 May 2007 05:22:48 +0000 (22:22 -0700)
committerLinus Torvalds <torvalds@woody.linux-foundation.org>
Fri, 11 May 2007 15:29:34 +0000 (08:29 -0700)
This got somehow lost in the noise.  This fixes coverity bug id #1025, if
Rup is greater or equal to MAX_RUP, we run past the Mapping Array.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Cc: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/char/rio/riocmd.c patch | blob | blame | history

diff --git a/drivers/char/rio/riocmd.c b/drivers/char/rio/riocmd.c
index 245f03195b7c6da9ce7f664e974664617b4baf33..8cc60b693460a2cbdbc9a1bca28c2a73724db162 100644 (file)
--- a/drivers/char/rio/riocmd.c
+++ b/drivers/char/rio/riocmd.c
@@ -402,7 +402,7 @@ static int RIOCommandRup(struct rio_info *p, uint Rup, struct Host *HostP, struc
                rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Host number %Zd, name ``%s''\n", HostP - p->RIOHosts, HostP->Name);
                rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Rup number  0x%x\n", rup);
 
-               if (Rup >= (unsigned short) MAX_RUP) {
+               if (Rup < (unsigned short) MAX_RUP) {
                        rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for RTA ``%s''\n", HostP->Mapping[Rup].Name);
                } else
                        rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for link ``%c'' of host ``%s''\n", ('A' + Rup - MAX_RUP), HostP->Name);