pnpacpi: fix potential corruption on "pnpacpi: exceeded the max number of IRQ resourc...

PNP_MAX_IRQ is 2
If a device invokes pnpacpi_parse_allocated_irqresource() 0, 1, or 2 times, we are happy.
The 3rd time, we will fail and print "pnpacpi: exceeded the max number of IRQ resources: 2"
The 4th and subsequent calls (if this ever happened) would silently scribble on
irq_resource[2], which doesn't actualy exist.

Found-by: Bjorn Helgaas <[email protected]>
Signed-off-by: Len Brown <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 2dcd1960aca844c5cc98e5796b11dec81cde6dbf..98cbc9f18eed36f281a00893e3ad0df58cfb0873 100644 (file)
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -84,10 +84,12 @@ static void pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res,
        while (!(res->irq_resource[i].flags & IORESOURCE_UNSET) &&
               i < PNP_MAX_IRQ)
                i++;
-       if (i >= PNP_MAX_IRQ && !warned) {
-               printk(KERN_WARNING "pnpacpi: exceeded the max number of IRQ "
-                               "resources: %d \n", PNP_MAX_IRQ);
-               warned = 1;
+       if (i >= PNP_MAX_IRQ) {
+               if (!warned) {
+                       printk(KERN_WARNING "pnpacpi: exceeded the max number"
+                               " of IRQ resources: %d\n", PNP_MAX_IRQ);
+                       warned = 1;
+               }
                return;
        }
        /*