From 6b9d8e80bb9edd0c9fe948a6ef105391de56b012 Mon Sep 17 00:00:00 2001
From: Roel Kluin <roel.kluin@gmail.com>
Date: Fri, 12 Jun 2009 10:26:34 +0200
Subject: [S390] qdio: fix access beyond ARRAY_SIZE of irq_ptr->{in,out}put_qs
Do not go beyond ARRAY_SIZE of irq_ptr->{in,out}put_qs
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
---
drivers/s390/cio/qdio_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
(limited to 'drivers/s390')
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index ba4facc3701..d79cf5bf0e6 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1494,7 +1494,7 @@ int do_QDIO(struct ccw_device *cdev, unsigned int callflags,
if ((bufnr > QDIO_MAX_BUFFERS_PER_Q) ||
(count > QDIO_MAX_BUFFERS_PER_Q) ||
- (q_nr > QDIO_MAX_QUEUES_PER_IRQ))
+ (q_nr >= QDIO_MAX_QUEUES_PER_IRQ))
return -EINVAL;
if (!count)
--
cgit