serial: jsm: some off by one bugs

"brd->nasync" amd "brd->maxports" are the same.  They hold the number of
filled out channels in the brd->channels[] array.  These tests should
be ">=" instead of ">" so that we don't read one element past the end.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/serial/jsm/jsm_cls.c b/drivers/tty/serial/jsm/jsm_cls.c
index bfb0681195b600354babc4fcc923473ecbaf44b3..4eb12a9cae76ce71e59745c4f4acde5b9d928bd5 100644 (file)
--- a/drivers/tty/serial/jsm/jsm_cls.c
+++ b/drivers/tty/serial/jsm/jsm_cls.c
@@ -570,7 +570,7 @@ static inline void cls_parse_isr(struct jsm_board *brd, uint port)
         * verified in the interrupt routine.
         */
 
-       if (port > brd->nasync)
+       if (port >= brd->nasync)
                return;
 
        ch = brd->channels[port];

diff --git a/drivers/tty/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c
index 7291c2117daaf180f54b314003366e235410d5bd..932b2accd06f7099e58adc04ff0fb4d028e81a18 100644 (file)
--- a/drivers/tty/serial/jsm/jsm_neo.c
+++ b/drivers/tty/serial/jsm/jsm_neo.c
@@ -724,7 +724,7 @@ static inline void neo_parse_isr(struct jsm_board *brd, u32 port)
        if (!brd)
                return;
 
-       if (port > brd->maxports)
+       if (port >= brd->maxports)
                return;
 
        ch = brd->channels[port];
@@ -840,7 +840,7 @@ static inline void neo_parse_lsr(struct jsm_board *brd, u32 port)
        if (!brd)
                return;
 
-       if (port > brd->maxports)
+       if (port >= brd->maxports)
                return;
 
        ch = brd->channels[port];
@@ -1180,7 +1180,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd)
                         */
 
                        /* Verify the port is in range. */
-                       if (port > brd->nasync)
+                       if (port >= brd->nasync)
                                continue;
 
                        ch = brd->channels[port];