[linux-yocto] [PATCH 05/28] LSI AXM55xx: Fixes for mailbox open bounds checks.

[Bruce Ashfield]

The same comments apply here. We should always describe the symptom of
what we are fixing.

What was broken before this change ?

Bruce

On 14-05-02 03:16 PM, Charlie Paul wrote:
> From: Michael Bringmann <michael.bringmann at lsi.com>
>
> Signed-off-by: Michael Bringmann <michael.bringmann at lsi.com>
> ---
>   drivers/rapidio/devices/lsi/axxia-rio-irq.c |    6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/rapidio/devices/lsi/axxia-rio-irq.c b/drivers/rapidio/devices/lsi/axxia-rio-irq.c
> index 2ffa34b..cb16281 100644
> --- a/drivers/rapidio/devices/lsi/axxia-rio-irq.c
> +++ b/drivers/rapidio/devices/lsi/axxia-rio-irq.c
> @@ -1013,7 +1013,7 @@ static inline int choose_ob_dme(
>   			if (len > sz)
>   				continue;
>
> -			if (dme->entries >= (dme->entries_in_use+1)) {
> +			if (dme->entries > (dme->entries_in_use+1)) {
>   				(*ob_dme) = dme;
>   				(*buf_sz) = sz;
>   				return ret + i;
> @@ -1290,7 +1290,7 @@ static int open_outb_mbox(struct rio_mport *mport, void *dev_id, int dme_no,
>   	u64 descChainStart, descAddr;
>   	int buf_sz = 0;
>
> -	if ((entries <= 0) || (entries > priv->desc_max_entries))
> +	if ((entries < 2) || (entries > priv->desc_max_entries))
>   		return -EINVAL;
>
>   	if (test_bit(RIO_IRQ_ENABLED, &h->state))
> @@ -1648,7 +1648,7 @@ static int open_inb_mbox(struct rio_mport *mport, void *dev_id,
>   	if ((mbox < 0) || (mbox >= RIO_MAX_RX_MBOX))
>   		return -EINVAL;
>
> -	if ((entries <= 0) || (entries > priv->desc_max_entries))
> +	if ((entries < 2) || (entries > priv->desc_max_entries))
>   		return -EINVAL;
>
>   	h = &priv->ib_dme_irq[mbox];
>