From: Eric Sesterhenn / Snakebyte <snakebyte@gmx.de>
Date: Wed, 23 May 2007 20:58:15 +0000 (-0700)
Subject: Off by one in floppy.c
X-Git-Tag: v2.6.22-rc3~31
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4acb3e2f97f41cf9b53182b494384467d3ceb304;p=linux-2.6

Off by one in floppy.c

Another coverity patch i forgot to resend, original thread here
http://marc.info/?l=linux-kernel&m=115144559823592&w=2

In case drive == N_DRIVE, we get one past the drive_params array.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 3587cb4343..fe088045dd 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -670,7 +670,7 @@ static void __reschedule_timeout(int drive, const char *message, int marg)
 	if (drive == current_reqD)
 		drive = current_drive;
 	del_timer(&fd_timeout);
-	if (drive < 0 || drive > N_DRIVE) {
+	if (drive < 0 || drive >= N_DRIVE) {
 		fd_timeout.expires = jiffies + 20UL * HZ;
 		drive = 0;
 	} else