Staging: Gasket: fix a couple off by one bugs
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 6 Jul 2018 08:38:25 +0000 (11:38 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 6 Jul 2018 15:35:42 +0000 (17:35 +0200)
The > should be >= or we end up writing one element beyond the end of
the interrupt_data->eventfd_ctxs[] array.

Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/gasket/gasket_interrupt.c

index 1fd7bee..d1461b3 100644 (file)
@@ -514,7 +514,7 @@ int gasket_interrupt_set_eventfd(
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
 
-       if (interrupt < 0 || interrupt > interrupt_data->num_interrupts)
+       if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
                return -EINVAL;
 
        interrupt_data->eventfd_ctxs[interrupt] = ctx;
@@ -524,7 +524,7 @@ int gasket_interrupt_set_eventfd(
 int gasket_interrupt_clear_eventfd(
        struct gasket_interrupt_data *interrupt_data, int interrupt)
 {
-       if (interrupt < 0 || interrupt > interrupt_data->num_interrupts)
+       if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
                return -EINVAL;
 
        interrupt_data->eventfd_ctxs[interrupt] = NULL;