>From 089bfb50f6f9426f1dfd48bfb07455224484b847 Mon Sep 17 00:00:00 2001 From: Luca Tettamanti <kronos.it@xxxxxxxxx> Date: Thu, 9 Aug 2007 21:19:49 +0200 Subject: [PATCH 14/30] Fix off-by-one error in debugfs helpers Fix an off-by-on error in debugfs code which may lead to read/write past the end of the data. Signed-Off-By: Luca Tettamanti <kronos.it@xxxxxxxxx> Signed-off-by: Ivo van Doorn <IvDoorn@xxxxxxxxx> --- drivers/net/wireless/rt2x00debug.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/rt2x00debug.c b/drivers/net/wireless/rt2x00debug.c index d6c4cfe..c7b331c 100644 --- a/drivers/net/wireless/rt2x00debug.c +++ b/drivers/net/wireless/rt2x00debug.c @@ -127,7 +127,7 @@ static ssize_t rt2x00debug_read_##__name(struct file *file, \ if (*offset) \ return 0; \ \ - if (intf->offset_##__name > debug->__name.word_count) \ + if (intf->offset_##__name >= debug->__name.word_count) \ return -EINVAL; \ \ debug->__name.read(intf->rt2x00dev, \ @@ -160,7 +160,7 @@ static ssize_t rt2x00debug_write_##__name(struct file *file, \ if (!capable(CAP_NET_ADMIN)) \ return -EPERM; \ \ - if (intf->offset_##__name > debug->__name.word_count) \ + if (intf->offset_##__name >= debug->__name.word_count) \ return -EINVAL; \ \ if (copy_from_user(line, buf, length)) \ -- 1.5.3.rc5 - To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
