From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 7 Feb 2017 13:17:07 +0000 (+0300)
Subject: staging: bcm2835-audio: off by one in snd_bcm2835_playback_open_generic()
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=84472ecd7074576143aaf2772a304138fa4f1a09;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

staging: bcm2835-audio: off by one in snd_bcm2835_playback_open_generic()

The > should be >= otherwise we write beyond the end of the array when
we do:

	chip->alsa_stream[idx] = alsa_stream;

Fixes: 23b028c871e1 ("staging: bcm2835-audio: initial staging submission")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/bcm2835-audio/bcm2835-pcm.c
index d2d9f9b6a09b..014bf7ab69f4 100644
--- a/drivers/staging/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/bcm2835-audio/bcm2835-pcm.c
@@ -130,7 +130,7 @@ static int snd_bcm2835_playback_open_generic(
 		err = -EBUSY;
 		goto out;
 	}
-	if (idx > MAX_SUBSTREAMS) {
+	if (idx >= MAX_SUBSTREAMS) {
 		audio_error
 			("substream(%d) device doesn't exist max(%d) substreams allowed\n",
 			idx, MAX_SUBSTREAMS);