Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4bef52f3 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: dgnc: some off by one bugs 



"dgnc_NumBoards" is the number of filled out elements in the
dgnc_Board[] array.  "->nasync" and "->maxports" are the same value.
They are the number of channels in the ->channels[] array so these tests
should be ">=" instead of ">" so we avoid reading past the end of the
arrays.

I cleaned up the conditions in dgnc_mgmt_ioctl() a bit.  There was a
work around for the off by one bug in the case where there were no
boards which is no longer needed.  "channel" is unsigned so it can't be
negative.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent edc16d8d

drivers/staging/dgnc/dgnc_cls.c

+1 −1
Original line number Diff line number Diff line
@@ -375,7 +375,7 @@ static inline void cls_parse_isr(struct dgnc_board *brd, uint port) 
	 * verified in the interrupt routine.

	 */



	if (port > brd->nasync)

	if (port >= brd->nasync)

		return;



	ch = brd->channels[port];

drivers/staging/dgnc/dgnc_mgmt.c

+2 −2
Original line number Diff line number Diff line
@@ -179,11 +179,11 @@ long dgnc_mgmt_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
		channel = ni.channel;



		/* Verify boundaries on board */

		if ((board > dgnc_NumBoards) || (dgnc_NumBoards == 0))

		if (board >= dgnc_NumBoards)

			return -ENODEV;



		/* Verify boundaries on channel */

		if ((channel < 0) || (channel > dgnc_Board[board]->nasync))

		if (channel >= dgnc_Board[board]->nasync)

			return -ENODEV;



		ch = dgnc_Board[board]->channels[channel];

drivers/staging/dgnc/dgnc_neo.c

+3 −3
Original line number Diff line number Diff line
@@ -391,7 +391,7 @@ static inline void neo_parse_isr(struct dgnc_board *brd, uint port) 
	if (!brd || brd->magic != DGNC_BOARD_MAGIC)

		return;



	if (port > brd->maxports)

	if (port >= brd->maxports)

		return;



	ch = brd->channels[port];
@@ -521,7 +521,7 @@ static inline void neo_parse_lsr(struct dgnc_board *brd, uint port) 
	if (!brd || brd->magic != DGNC_BOARD_MAGIC)

		return;



	if (port > brd->maxports)

	if (port >= brd->maxports)

		return;



	ch = brd->channels[port];
@@ -1003,7 +1003,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd) 
			 */



			/* Verify the port is in range. */

			if (port > brd->nasync)

			if (port >= brd->nasync)

				continue;



			ch = brd->channels[port];

drivers/staging/dgnc/dgnc_tty.c

+1 −1
Original line number Diff line number Diff line
@@ -1042,7 +1042,7 @@ static int dgnc_tty_open(struct tty_struct *tty, struct file *file) 
	spin_lock_irqsave(&brd->bd_lock, flags);



	/* If opened device is greater than our number of ports, bail. */

	if (PORT_NUM(minor) > brd->nasync) {

	if (PORT_NUM(minor) >= brd->nasync) {

		spin_unlock_irqrestore(&brd->bd_lock, flags);

		return -ENXIO;

	}