Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a666b54a authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

serial: jsm: some off by one bugs 



"brd->nasync" amd "brd->maxports" are the same.  They hold the number of
filled out channels in the brd->channels[] array.  These tests should
be ">=" instead of ">" so that we don't read one element past the end.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarThadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 136debf7

drivers/tty/serial/jsm/jsm_cls.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -570,7 +570,7 @@ static inline void cls_parse_isr(struct jsm_board *brd, uint port) 
	 * verified in the interrupt routine.

	 * verified in the interrupt routine.

	 */

	 */





	if (port > brd->nasync)

	if (port >= brd->nasync)

		return;

		return;





	ch = brd->channels[port];

	ch = brd->channels[port];

drivers/tty/serial/jsm/jsm_neo.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -724,7 +724,7 @@ static inline void neo_parse_isr(struct jsm_board *brd, u32 port) 
	if (!brd)

	if (!brd)

		return;

		return;





	if (port > brd->maxports)

	if (port >= brd->maxports)

		return;

		return;





	ch = brd->channels[port];

	ch = brd->channels[port];
@@ -840,7 +840,7 @@ static inline void neo_parse_lsr(struct jsm_board *brd, u32 port) 
	if (!brd)

	if (!brd)

		return;

		return;





	if (port > brd->maxports)

	if (port >= brd->maxports)

		return;

		return;





	ch = brd->channels[port];

	ch = brd->channels[port];
@@ -1180,7 +1180,7 @@ static irqreturn_t neo_intr(int irq, void *voidbrd) 
			 */

			 */





			/* Verify the port is in range. */

			/* Verify the port is in range. */

			if (port > brd->nasync)

			if (port >= brd->nasync)

				continue;

				continue;





			ch = brd->channels[port];

			ch = brd->channels[port];