* [Patch] Off by one in drivers/block/floppy.c
@ 2006-06-27 21:57 Eric Sesterhenn
0 siblings, 0 replies; 2+ messages in thread
From: Eric Sesterhenn @ 2006-06-27 21:57 UTC (permalink / raw)
To: linux-kernel
hi,
another bug spotted by coverity (id #481).
In the case that drive == N_DRIVE we acess past the
drive_params array which is defined as
drive_params[N_DRIVE]. By using the UDP define
in the else case because UDP is &drive_params[drive]
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
--- linux-2.6.17-git11/drivers/block/floppy.c.orig 2006-06-27 23:49:22.000000000 +0200
+++ linux-2.6.17-git11/drivers/block/floppy.c 2006-06-27 23:49:40.000000000 +0200
@@ -684,7 +684,7 @@ static void __reschedule_timeout(int dri
if (drive == current_reqD)
drive = current_drive;
del_timer(&fd_timeout);
- if (drive < 0 || drive > N_DRIVE) {
+ if (drive < 0 || drive > N_DRIVE-1) {
fd_timeout.expires = jiffies + 20UL * HZ;
drive = 0;
} else
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [Patch] Off by one in drivers/block/floppy.c
[not found] <mailman.1151538660.27595.linux-kernel2news@redhat.com>
@ 2006-06-30 7:38 ` Pete Zaitcev
0 siblings, 0 replies; 2+ messages in thread
From: Pete Zaitcev @ 2006-06-30 7:38 UTC (permalink / raw)
To: Eric Sesterhenn; +Cc: linux-kernel
On Tue, 27 Jun 2006 23:57:49 +0200, Eric Sesterhenn <snakebyte@gmx.de> wrote:
> +++ linux-2.6.17-git11/drivers/block/floppy.c 2006-06-27 23:49:40.000000000 +0200
> @@ -684,7 +684,7 @@ static void __reschedule_timeout(int dri
> if (drive == current_reqD)
> drive = current_drive;
> del_timer(&fd_timeout);
> - if (drive < 0 || drive > N_DRIVE) {
> + if (drive < 0 || drive > N_DRIVE-1) {
> fd_timeout.expires = jiffies + 20UL * HZ;
Looks ok, although the idiom is "drive >= N_DRIVE".
-- Pete
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-06-30 7:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-06-27 21:57 [Patch] Off by one in drivers/block/floppy.c Eric Sesterhenn
[not found] <mailman.1151538660.27595.linux-kernel2news@redhat.com>
2006-06-30 7:38 ` Pete Zaitcev
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox