tty: mxser: fix cycle termination condition in mxser_probe() and mxser_module_init()
authorAlexey Khoroshilov <khoroshilov@ispras.ru>
Sun, 7 Apr 2013 19:46:47 +0000 (23:46 +0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 8 Apr 2013 18:30:04 +0000 (11:30 -0700)
There is a bug in resources deallocation code in mxser_probe() and
mxser_module_init().  As soon as variable 'i' is unsigned int, cycle
termination condition i >= 0 is always true.  The patch fixes the issue.

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/mxser.c

index 484b6a3c9b03714a3eae559e061f3767cdc3af72..302909ccf18383831e5f6091f167be354b4db989 100644 (file)
@@ -2643,9 +2643,9 @@ static int mxser_probe(struct pci_dev *pdev,
                                mxvar_sdriver, brd->idx + i, &pdev->dev);
                if (IS_ERR(tty_dev)) {
                        retval = PTR_ERR(tty_dev);
-                       for (i--; i >= 0; i--)
+                       for (; i > 0; i--)
                                tty_unregister_device(mxvar_sdriver,
-                                       brd->idx + i);
+                                       brd->idx + i - 1);
                        goto err_relbrd;
                }
        }
@@ -2751,9 +2751,9 @@ static int __init mxser_module_init(void)
                        tty_dev = tty_port_register_device(&brd->ports[i].port,
                                        mxvar_sdriver, brd->idx + i, NULL);
                        if (IS_ERR(tty_dev)) {
-                               for (i--; i >= 0; i--)
+                               for (; i > 0; i--)
                                        tty_unregister_device(mxvar_sdriver,
-                                               brd->idx + i);
+                                               brd->idx + i - 1);
                                for (i = 0; i < brd->info->nports; i++)
                                        tty_port_destroy(&brd->ports[i].port);
                                free_irq(brd->irq, brd);