All of lore.kernel.org
 help / color / mirror / Atom feed
* [patch] gpio: grgpio: off by one in grgpio_to_irq()
@ 2014-12-16 23:53 ` Dan Carpenter
  0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2014-12-16 23:53 UTC (permalink / raw)
  To: Linus Walleij
  Cc: Alexandre Courbot, Grant Likely, Rob Herring, linux-gpio,
	kernel-janitors

"gc->ngpio" is a number between 1 and GRGPIO_MAX_NGPIO.  If "offset" is
GRGPIO_MAX_NGPIO then we're going one step beyond the end of the
priv->lirqs[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
index 09daaf2..d5bc70f 100644
--- a/drivers/gpio/gpio-grgpio.c
+++ b/drivers/gpio/gpio-grgpio.c
@@ -121,7 +121,7 @@ static int grgpio_to_irq(struct gpio_chip *gc, unsigned offset)
 {
 	struct grgpio_priv *priv = grgpio_gc_to_priv(gc);
 
-	if (offset > gc->ngpio)
+	if (offset >= gc->ngpio)
 		return -ENXIO;
 
 	if (priv->lirqs[offset].index < 0)

^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2015-01-13  9:22 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-16 23:53 [patch] gpio: grgpio: off by one in grgpio_to_irq() Dan Carpenter
2014-12-16 23:53 ` Dan Carpenter
2014-12-17  2:18 ` Alexandre Courbot
2014-12-17  2:18   ` Alexandre Courbot
2015-01-13  9:22 ` Linus Walleij
2015-01-13  9:22   ` Linus Walleij

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.