From: Eric Sesterhenn / Snakebyte Date: Wed, 23 May 2007 20:58:15 +0000 (-0700) Subject: Off by one in floppy.c X-Git-Tag: v2.6.22-rc3~31 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4acb3e2f97f41cf9b53182b494384467d3ceb304;p=linux-2.6 Off by one in floppy.c Another coverity patch i forgot to resend, original thread here http://marc.info/?l=linux-kernel&m=115144559823592&w=2 In case drive == N_DRIVE, we get one past the drive_params array. Signed-off-by: Eric Sesterhenn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 3587cb4343..fe088045dd 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -670,7 +670,7 @@ static void __reschedule_timeout(int drive, const char *message, int marg) if (drive == current_reqD) drive = current_drive; del_timer(&fd_timeout); - if (drive < 0 || drive > N_DRIVE) { + if (drive < 0 || drive >= N_DRIVE) { fd_timeout.expires = jiffies + 20UL * HZ; drive = 0; } else