* [patch] mtd: off by one in INFTL_dumpVUchains()
@ 2014-10-21 8:08 Dan Carpenter
2014-11-05 21:20 ` Brian Norris
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2014-10-21 8:08 UTC (permalink / raw)
To: David Woodhouse; +Cc: kernel-janitors, Brian Norris, linux-mtd
The ->PUtable[] array has "->nb_blocks" number of elemetns so this
comparison should be ">=" instead of ">". Otherwise it could result in
a minor read beyond the end of an array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Static analysis stuff. Not tested.
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index 487e64f..1388c8d 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -518,7 +518,7 @@ void INFTL_dumpVUchains(struct INFTLrecord *s)
pr_debug("INFTL Virtual Unit Chains:\n");
for (logical = 0; logical < s->nb_blocks; logical++) {
block = s->VUtable[logical];
- if (block > s->nb_blocks)
+ if (block >= s->nb_blocks)
continue;
pr_debug(" LOGICAL %d --> %d ", logical, block);
for (i = 0; i < s->nb_blocks; i++) {
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] mtd: off by one in INFTL_dumpVUchains()
2014-10-21 8:08 [patch] mtd: off by one in INFTL_dumpVUchains() Dan Carpenter
@ 2014-11-05 21:20 ` Brian Norris
0 siblings, 0 replies; 2+ messages in thread
From: Brian Norris @ 2014-11-05 21:20 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-mtd, kernel-janitors, David Woodhouse
On Tue, Oct 21, 2014 at 11:08:35AM +0300, Dan Carpenter wrote:
> The ->PUtable[] array has "->nb_blocks" number of elemetns so this
> comparison should be ">=" instead of ">". Otherwise it could result in
> a minor read beyond the end of an array.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Pushed to l2-mtd.git.
Brian
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-11-05 21:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-21 8:08 [patch] mtd: off by one in INFTL_dumpVUchains() Dan Carpenter
2014-11-05 21:20 ` Brian Norris
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox