[PATCH] coverity: ipmi_msghandler() channels array overrun fix

We fix the check in 1084, which was

1084 if (addr->channel > IPMI_NUM_CHANNELS) {
1085 spin_lock_irqsave(&intf->counter_lock, flags);
1086 intf->sent_invalid_commands++;
1087 spin_unlock_irqrestore(&intf->counter_lock, flags);
1088 rv = -EINVAL;
1089 goto out_err;
1090 }

addr->channel is used in

1092 if (intf->channels[addr->channel].medium

Definitions involved:

221 struct ipmi_channel channels[IPMI_MAX_CHANNELS];

134 #define IPMI_MAX_CHANNELS 8

In /linux-2.6.12-rc6/include/linux/ipmi.h
148 #define IPMI_NUM_CHANNELS 0x10

Signed-off-by: Zaur Kambarov <[e-mail]>
Cc: Corey Minyard <[e-mail]>
Signed-off-by: Andrew Morton <[e-mail]>
Signed-off-by: Linus Torvalds <[e-mail]>

drivers/char/ipmi/ipmi_msghandler.c

···
 		long                  seqid;
 		int                   broadcast = 0;
 
-		if (addr->channel > IPMI_NUM_CHANNELS) {
-			spin_lock_irqsave(&intf->counter_lock, flags);
+		if (addr->channel >= IPMI_MAX_CHANNELS) {
+		        spin_lock_irqsave(&intf->counter_lock, flags);
 			intf->sent_invalid_commands++;
 			spin_unlock_irqrestore(&intf->counter_lock, flags);
 			rv = -EINVAL;