From 652d703b21eb1caf2673c10bd58e4b0121dc7c50 Mon Sep 17 00:00:00 2001 From: "Srivatsa S. Bhat" Date: Mon, 5 Feb 2018 18:25:09 -0800 Subject: char_dev: Fix off-by-one bugs in find_dynamic_major() CHRDEV_MAJOR_DYN_END and CHRDEV_MAJOR_DYN_EXT_END are valid major numbers. So fix the loop iteration to include them in the search for free major numbers. While at it, also remove a redundant if condition ("cd->major != i"), as it will never be true. Signed-off-by: Srivatsa S. Bhat Reviewed-by: Logan Gunthorpe Signed-off-by: Greg Kroah-Hartman --- fs/char_dev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'fs/char_dev.c') diff --git a/fs/char_dev.c b/fs/char_dev.c index a65e4a56318c..33c938542160 100644 --- a/fs/char_dev.c +++ b/fs/char_dev.c @@ -67,18 +67,18 @@ static int find_dynamic_major(void) int i; struct char_device_struct *cd; - for (i = ARRAY_SIZE(chrdevs)-1; i > CHRDEV_MAJOR_DYN_END; i--) { + for (i = ARRAY_SIZE(chrdevs)-1; i >= CHRDEV_MAJOR_DYN_END; i--) { if (chrdevs[i] == NULL) return i; } for (i = CHRDEV_MAJOR_DYN_EXT_START; - i > CHRDEV_MAJOR_DYN_EXT_END; i--) { + i >= CHRDEV_MAJOR_DYN_EXT_END; i--) { for (cd = chrdevs[major_to_index(i)]; cd; cd = cd->next) if (cd->major == i) break; - if (cd == NULL || cd->major != i) + if (cd == NULL) return i; } -- cgit