From 4acb3e2f97f41cf9b53182b494384467d3ceb304 Mon Sep 17 00:00:00 2001 From: Eric Sesterhenn / Snakebyte Date: Wed, 23 May 2007 13:58:15 -0700 Subject: Off by one in floppy.c Another coverity patch i forgot to resend, original thread here http://marc.info/?l=linux-kernel&m=115144559823592&w=2 In case drive == N_DRIVE, we get one past the drive_params array. Signed-off-by: Eric Sesterhenn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 3587cb434371..fe088045dd08 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -670,7 +670,7 @@ static void __reschedule_timeout(int drive, const char *message, int marg) if (drive == current_reqD) drive = current_drive; del_timer(&fd_timeout); - if (drive < 0 || drive > N_DRIVE) { + if (drive < 0 || drive >= N_DRIVE) { fd_timeout.expires = jiffies + 20UL * HZ; drive = 0; } else -- cgit v1.2.3