* [patch] input: off by one in pcf8574_kp_irq_handler()
@ 2010-06-04 23:19 Dan Carpenter
2010-06-05 6:50 ` Jean Delvare
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2010-06-04 23:19 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Mike Frysinger, Jean Delvare, Greg Kroah-Hartman, Richard Purdie,
linux-input, kernel-janitors
If nextstate == ARRAY_SIZE(lp->btncode), then we read one past the end of
the array on the next line.
This fixes a smatch warning:
drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)
error: buffer overflow 'lp->btncode' 17 <= 17
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
index 0ac47d2..4b42ffc 100644
--- a/drivers/input/misc/pcf8574_keypad.c
+++ b/drivers/input/misc/pcf8574_keypad.c
@@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
unsigned char nextstate = read_state(lp);
if (lp->laststate != nextstate) {
- int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
+ int key_down = nextstate < ARRAY_SIZE(lp->btncode);
unsigned short keycode = key_down ?
lp->btncode[nextstate] : lp->btncode[lp->laststate];
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [patch] input: off by one in pcf8574_kp_irq_handler()
2010-06-04 23:19 [patch] input: off by one in pcf8574_kp_irq_handler() Dan Carpenter
@ 2010-06-05 6:50 ` Jean Delvare
2010-06-05 7:36 ` Dmitry Torokhov
0 siblings, 1 reply; 3+ messages in thread
From: Jean Delvare @ 2010-06-05 6:50 UTC (permalink / raw)
To: Dan Carpenter
Cc: Dmitry Torokhov, Mike Frysinger, Greg Kroah-Hartman,
Richard Purdie, linux-input, kernel-janitors
Hi Dan,
On Sat, 5 Jun 2010 01:19:39 +0200, Dan Carpenter wrote:
> If nextstate == ARRAY_SIZE(lp->btncode), then we read one past the end of
> the array on the next line.
>
> This fixes a smatch warning:
> drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)
> error: buffer overflow 'lp->btncode' 17 <= 17
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
> index 0ac47d2..4b42ffc 100644
> --- a/drivers/input/misc/pcf8574_keypad.c
> +++ b/drivers/input/misc/pcf8574_keypad.c
> @@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
> unsigned char nextstate = read_state(lp);
>
> if (lp->laststate != nextstate) {
> - int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
> + int key_down = nextstate < ARRAY_SIZE(lp->btncode);
> unsigned short keycode = key_down ?
> lp->btncode[nextstate] : lp->btncode[lp->laststate];
>
Good catch.
Acked-by: Jean Delvare <khali@linux-fr.org>
--
Jean Delvare
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [patch] input: off by one in pcf8574_kp_irq_handler()
2010-06-05 6:50 ` Jean Delvare
@ 2010-06-05 7:36 ` Dmitry Torokhov
0 siblings, 0 replies; 3+ messages in thread
From: Dmitry Torokhov @ 2010-06-05 7:36 UTC (permalink / raw)
To: Jean Delvare
Cc: Dan Carpenter, Mike Frysinger, Greg Kroah-Hartman, Richard Purdie,
linux-input, kernel-janitors
On Sat, Jun 05, 2010 at 08:50:02AM +0200, Jean Delvare wrote:
> Hi Dan,
>
> On Sat, 5 Jun 2010 01:19:39 +0200, Dan Carpenter wrote:
> > If nextstate == ARRAY_SIZE(lp->btncode), then we read one past the end of
> > the array on the next line.
> >
> > This fixes a smatch warning:
> > drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)
> > error: buffer overflow 'lp->btncode' 17 <= 17
> >
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
> >
> > diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
> > index 0ac47d2..4b42ffc 100644
> > --- a/drivers/input/misc/pcf8574_keypad.c
> > +++ b/drivers/input/misc/pcf8574_keypad.c
> > @@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
> > unsigned char nextstate = read_state(lp);
> >
> > if (lp->laststate != nextstate) {
> > - int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
> > + int key_down = nextstate < ARRAY_SIZE(lp->btncode);
> > unsigned short keycode = key_down ?
> > lp->btncode[nextstate] : lp->btncode[lp->laststate];
> >
>
> Good catch.
>
> Acked-by: Jean Delvare <khali@linux-fr.org>
>
Applied to 'for-linus', thanks Dan.
--
Dmitry
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-06-05 7:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-06-04 23:19 [patch] input: off by one in pcf8574_kp_irq_handler() Dan Carpenter
2010-06-05 6:50 ` Jean Delvare
2010-06-05 7:36 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).