From: Dan Carpenter Date: Fri, 6 Jul 2018 08:38:25 +0000 (+0300) Subject: Staging: Gasket: fix a couple off by one bugs X-Git-Tag: Ubuntu-5.13.0-19.19~10366^2~616 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=7cc6dfd076e84359a96a851c41ac8dc696565a3f;p=mirror_ubuntu-jammy-kernel.git Staging: Gasket: fix a couple off by one bugs The > should be >= or we end up writing one element beyond the end of the interrupt_data->eventfd_ctxs[] array. Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c index 1fd7bee5db2f..d1461b36f091 100644 --- a/drivers/staging/gasket/gasket_interrupt.c +++ b/drivers/staging/gasket/gasket_interrupt.c @@ -514,7 +514,7 @@ int gasket_interrupt_set_eventfd( if (IS_ERR(ctx)) return PTR_ERR(ctx); - if (interrupt < 0 || interrupt > interrupt_data->num_interrupts) + if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts) return -EINVAL; interrupt_data->eventfd_ctxs[interrupt] = ctx; @@ -524,7 +524,7 @@ int gasket_interrupt_set_eventfd( int gasket_interrupt_clear_eventfd( struct gasket_interrupt_data *interrupt_data, int interrupt) { - if (interrupt < 0 || interrupt > interrupt_data->num_interrupts) + if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts) return -EINVAL; interrupt_data->eventfd_ctxs[interrupt] = NULL;