diff options
| author |   H Hartley Sweeten <hsweeten@visionengravers.com> | 2015-01-28 09:58:56 -0700 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-02-07 17:02:13 +0800 |
| commit | 76925260a8edba2b62b1639d651b0f3072e7c01b (patch) | |
| tree | 5718cb7a50d25182fde1ffe4c0267c03098608c5 /drivers/staging/comedi/drivers/addi_apci_1500.c | |
| parent | staging: cptm1217: blow it all away (diff) | |
| download | linux-dev-76925260a8edba2b62b1639d651b0f3072e7c01b.tar.xz linux-dev-76925260a8edba2b62b1639d651b0f3072e7c01b.zip | |
staging: comedi: addi_apci_1500: fix array access out of bounds error
The private data 'pm', 'pt', and 'pp' array members hold the trigger mode
parameters for ports A and B. Both ports are 8-bits and the arrays are 16-bits.
Array index 0 defines the AND mode and index 1 the OR mode parameters for both
ports.
The valid triggers to start the async command are 0 to 3 which select the
AND/OR mode for each port.
The 'pb_trig' (the array index for port B) in apci1500_di_inttrig_start() is
incorrect and results in an index of 0 or 2. Fix the calc so that the correct
index (0/1) is used.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reported-by: Asaf Vertz <asaf.vertz@tandemg.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/comedi/drivers/addi_apci_1500.c')
| -rw-r--r-- | drivers/staging/comedi/drivers/addi_apci_1500.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c index fc7db1de0b90..f15aa1f6b476 100644 --- a/drivers/staging/comedi/drivers/addi_apci_1500.c +++ b/drivers/staging/comedi/drivers/addi_apci_1500.c @@ -296,7 +296,7 @@ static int apci1500_di_inttrig_start(struct comedi_device *dev, unsigned int pa_mode = Z8536_PAB_MODE_PMS_DISABLE; unsigned int pb_mode = Z8536_PAB_MODE_PMS_DISABLE; unsigned int pa_trig = trig_num & 0x01; - unsigned int pb_trig = trig_num & 0x02; + unsigned int pb_trig = (trig_num >> 1) & 0x01; bool valid_trig = false; unsigned int val; |