From 7cc6dfd076e84359a96a851c41ac8dc696565a3f Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 6 Jul 2018 11:38:25 +0300
Subject: [PATCH] Staging: Gasket: fix a couple off by one bugs
The > should be >= or we end up writing one element beyond the end of
the interrupt_data->eventfd_ctxs[] array.
Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/gasket/gasket_interrupt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c
index 1fd7bee5db2fd..d1461b36f0918 100644
--- a/drivers/staging/gasket/gasket_interrupt.c
+++ b/drivers/staging/gasket/gasket_interrupt.c
@@ -514,7 +514,7 @@ int gasket_interrupt_set_eventfd(
if (IS_ERR(ctx))
return PTR_ERR(ctx);
- if (interrupt < 0 || interrupt > interrupt_data->num_interrupts)
+ if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
return -EINVAL;
interrupt_data->eventfd_ctxs[interrupt] = ctx;
@@ -524,7 +524,7 @@ int gasket_interrupt_set_eventfd(
int gasket_interrupt_clear_eventfd(
struct gasket_interrupt_data *interrupt_data, int interrupt)
{
- if (interrupt < 0 || interrupt > interrupt_data->num_interrupts)
+ if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
return -EINVAL;
interrupt_data->eventfd_ctxs[interrupt] = NULL;
--
GitLab