From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 11 Mar 2015 09:36:07 +0000 (+0300)
Subject: thinkpad_acpi: off by one in adaptive_keyboard_hotkey_notify_hotkey()
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=741d98c733b6605fc621c5c8740c7120ae1c0006;p=sagit-ice-cold%2Fkernel_xiaomi_msm8998.git

thinkpad_acpi: off by one in adaptive_keyboard_hotkey_notify_hotkey()

This should be >= instead of > because otherwise we read one element
past the end of the hotkey_keycode_map[] array.

The hotkey_keycode_map[] array has TPACPI_HOTKEY_MAP_LEN elements.

Fixes: 6a68d8557084 ('thinkpad_acpi: Add support for more adaptive kbd buttons')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-By: Bastien Nocera <hadess@hadess.net>
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
---

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 024861db1587..7769575345d8 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3656,8 +3656,9 @@ static bool adaptive_keyboard_hotkey_notify_hotkey(unsigned int scancode)
 		return true;
 
 	default:
-		if (scancode < FIRST_ADAPTIVE_KEY || scancode > FIRST_ADAPTIVE_KEY +
-				TPACPI_HOTKEY_MAP_LEN - ADAPTIVE_KEY_OFFSET) {
+		if (scancode < FIRST_ADAPTIVE_KEY ||
+		    scancode >= FIRST_ADAPTIVE_KEY + TPACPI_HOTKEY_MAP_LEN -
+				ADAPTIVE_KEY_OFFSET) {
 			pr_info("Unhandled adaptive keyboard key: 0x%x\n",
 					scancode);
 			return false;