Ensure that q_nr is within the bounds of array irq_ptr->input_qs[] and ->output_qs[]. Signed-off-by: Roel Kluin <roel.kluin@xxxxxxxxx> --- I didn't notice this when writing my previous patch. Should bufnr and count be larger than 0 as well? diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c index d79cf5b..9dbc4b1 100644 --- a/drivers/s390/cio/qdio_main.c +++ b/drivers/s390/cio/qdio_main.c @@ -1494,7 +1494,7 @@ int do_QDIO(struct ccw_device *cdev, unsigned int callflags, if ((bufnr > QDIO_MAX_BUFFERS_PER_Q) || (count > QDIO_MAX_BUFFERS_PER_Q) || - (q_nr >= QDIO_MAX_QUEUES_PER_IRQ)) + (q_nr >= QDIO_MAX_QUEUES_PER_IRQ) || (q_nr < 0)) return -EINVAL; if (!count) -- To unsubscribe from this list: send the line "unsubscribe linux-s390" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
