aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLen Brown <len.brown@intel.com>2008-04-23 00:09:13 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-04-23 12:22:13 -0700
commit0093cb1199ec551f179562ca9fbd6f64fb750645 (patch)
treea17c2166db3d0f78d3ef7400d396476a70c58903
parent94bc891b00e40cbec375feb4568780af183fd7f4 (diff)
pnpacpi: fix potential corruption on "pnpacpi: exceeded the max number of IRQ resources 2"
PNP_MAX_IRQ is 2 If a device invokes pnpacpi_parse_allocated_irqresource() 0, 1, or 2 times, we are happy. The 3rd time, we will fail and print "pnpacpi: exceeded the max number of IRQ resources: 2" The 4th and subsequent calls (if this ever happened) would silently scribble on irq_resource[2], which doesn't actualy exist. Found-by: Bjorn Helgaas <bjorn.helgaas@hp.com> Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/pnp/pnpacpi/rsparser.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 2dcd1960aca..98cbc9f18ee 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -84,10 +84,12 @@ static void pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res,
while (!(res->irq_resource[i].flags & IORESOURCE_UNSET) &&
i < PNP_MAX_IRQ)
i++;
- if (i >= PNP_MAX_IRQ && !warned) {
- printk(KERN_WARNING "pnpacpi: exceeded the max number of IRQ "
- "resources: %d \n", PNP_MAX_IRQ);
- warned = 1;
+ if (i >= PNP_MAX_IRQ) {
+ if (!warned) {
+ printk(KERN_WARNING "pnpacpi: exceeded the max number"
+ " of IRQ resources: %d\n", PNP_MAX_IRQ);
+ warned = 1;
+ }
return;
}
/*