[linux-yocto] [PATCH 05/28] LSI AXM55xx: Fixes for mailbox open bounds checks.

[Charlie Paul]

From: Michael Bringmann <michael.bringmann at lsi.com>

Signed-off-by: Michael Bringmann <michael.bringmann at lsi.com>
---
 drivers/rapidio/devices/lsi/axxia-rio-irq.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/rapidio/devices/lsi/axxia-rio-irq.c b/drivers/rapidio/devices/lsi/axxia-rio-irq.c
index 2ffa34b..cb16281 100644
--- a/drivers/rapidio/devices/lsi/axxia-rio-irq.c
+++ b/drivers/rapidio/devices/lsi/axxia-rio-irq.c
@@ -1013,7 +1013,7 @@ static inline int choose_ob_dme(
 			if (len > sz)
 				continue;
 
-			if (dme->entries >= (dme->entries_in_use+1)) {
+			if (dme->entries > (dme->entries_in_use+1)) {
 				(*ob_dme) = dme;
 				(*buf_sz) = sz;
 				return ret + i;
@@ -1290,7 +1290,7 @@ static int open_outb_mbox(struct rio_mport *mport, void *dev_id, int dme_no,
 	u64 descChainStart, descAddr;
 	int buf_sz = 0;
 
-	if ((entries <= 0) || (entries > priv->desc_max_entries))
+	if ((entries < 2) || (entries > priv->desc_max_entries))
 		return -EINVAL;
 
 	if (test_bit(RIO_IRQ_ENABLED, &h->state))
@@ -1648,7 +1648,7 @@ static int open_inb_mbox(struct rio_mport *mport, void *dev_id,
 	if ((mbox < 0) || (mbox >= RIO_MAX_RX_MBOX))
 		return -EINVAL;
 
-	if ((entries <= 0) || (entries > priv->desc_max_entries))
+	if ((entries < 2) || (entries > priv->desc_max_entries))
 		return -EINVAL;
 
 	h = &priv->ib_dme_irq[mbox];
-- 
1.7.9.5