From: Eric Sesterhenn / Snakebyte Date: Fri, 11 May 2007 05:22:48 +0000 (-0700) Subject: Overrun in drivers/char/rio/riocmd.c X-Git-Tag: v2.6.22-rc1~75 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=84ea77635b91a6ca1c0c592ee5ddc0c780856b97;p=linux-2.6 Overrun in drivers/char/rio/riocmd.c This got somehow lost in the noise. This fixes coverity bug id #1025, if Rup is greater or equal to MAX_RUP, we run past the Mapping Array. Signed-off-by: Eric Sesterhenn Cc: Jiri Slaby Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/char/rio/riocmd.c b/drivers/char/rio/riocmd.c index 245f03195b..8cc60b6934 100644 --- a/drivers/char/rio/riocmd.c +++ b/drivers/char/rio/riocmd.c @@ -402,7 +402,7 @@ static int RIOCommandRup(struct rio_info *p, uint Rup, struct Host *HostP, struc rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Host number %Zd, name ``%s''\n", HostP - p->RIOHosts, HostP->Name); rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Rup number 0x%x\n", rup); - if (Rup >= (unsigned short) MAX_RUP) { + if (Rup < (unsigned short) MAX_RUP) { rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for RTA ``%s''\n", HostP->Mapping[Rup].Name); } else rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for link ``%c'' of host ``%s''\n", ('A' + Rup - MAX_RUP), HostP->Name);