summaryrefslogtreecommitdiff
path: root/drivers/char/rio
diff options
context:
space:
mode:
authorEric Sesterhenn / Snakebyte <snakebyte@gmx.de>2007-05-10 22:22:48 -0700
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-05-11 08:29:34 -0700
commit84ea77635b91a6ca1c0c592ee5ddc0c780856b97 (patch)
tree72df964edd4083e8c5c6bd180792293b2d4edaa5 /drivers/char/rio
parenta12bb44471b819c7f33d8a83044e7116c124e3d5 (diff)
downloadlinux-3.10-84ea77635b91a6ca1c0c592ee5ddc0c780856b97.tar.gz
linux-3.10-84ea77635b91a6ca1c0c592ee5ddc0c780856b97.tar.bz2
linux-3.10-84ea77635b91a6ca1c0c592ee5ddc0c780856b97.zip
Overrun in drivers/char/rio/riocmd.c
This got somehow lost in the noise. This fixes coverity bug id #1025, if Rup is greater or equal to MAX_RUP, we run past the Mapping Array. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Cc: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/char/rio')
-rw-r--r--drivers/char/rio/riocmd.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/rio/riocmd.c b/drivers/char/rio/riocmd.c
index 245f03195b7..8cc60b69346 100644
--- a/drivers/char/rio/riocmd.c
+++ b/drivers/char/rio/riocmd.c
@@ -402,7 +402,7 @@ static int RIOCommandRup(struct rio_info *p, uint Rup, struct Host *HostP, struc
rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Host number %Zd, name ``%s''\n", HostP - p->RIOHosts, HostP->Name);
rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: Rup number 0x%x\n", rup);
- if (Rup >= (unsigned short) MAX_RUP) {
+ if (Rup < (unsigned short) MAX_RUP) {
rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for RTA ``%s''\n", HostP->Mapping[Rup].Name);
} else
rio_dprintk(RIO_DEBUG_CMD, "CONTROL information: This is the RUP for link ``%c'' of host ``%s''\n", ('A' + Rup - MAX_RUP), HostP->Name);