diff options
| author | Bruce Evans <bde@FreeBSD.org> | 2016-08-25 12:04:57 +0000 |
|---|---|---|
| committer | Bruce Evans <bde@FreeBSD.org> | 2016-08-25 12:04:57 +0000 |
| commit | 9f25943b82ad90234fdfa531dd53649b1abfb3e4 (patch) | |
| tree | 0424508c01147d6e72a7537f2f38c98a788a795a /sys/dev/syscons | |
| parent | d5911afb79ff69c1d32c55e01496900f7ce9771b (diff) | |
| download | src-9f25943b82ad90234fdfa531dd53649b1abfb3e4.tar.gz src-9f25943b82ad90234fdfa531dd53649b1abfb3e4.zip | |
Fix logic errors in bounds checks in previous commit. The 2-entry stack
was overrun for grab levels larger than 2.
Reported by: pluknet
Notes
Notes:
svn path=/head/; revision=304800
Diffstat (limited to 'sys/dev/syscons')
| -rw-r--r-- | sys/dev/syscons/syscons.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/syscons/syscons.c b/sys/dev/syscons/syscons.c index 4c9e881eb133..7a02990b443b 100644 --- a/sys/dev/syscons/syscons.c +++ b/sys/dev/syscons/syscons.c @@ -1729,7 +1729,7 @@ sc_cngrab(struct consdev *cp) sc = sc_console->sc; lev = atomic_fetchadd_int(&sc->grab_level, 1); - if (lev >= 0 || lev < 2) + if (lev >= 0 && lev < 2) sccnopen(sc, &sc->grab_state[lev], 1 | 2); } @@ -1741,7 +1741,7 @@ sc_cnungrab(struct consdev *cp) sc = sc_console->sc; lev = atomic_load_acq_int(&sc->grab_level) - 1; - if (lev >= 0 || lev < 2) + if (lev >= 0 && lev < 2) sccnclose(sc, &sc->grab_state[lev]); atomic_add_int(&sc->grab_level, -1); } |