x86/ldt: Fix off by one in get_segment_base()

[karo-tx-linux.git] / arch / x86 / events / core.c

diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index af12e294caeda5f518cf8b80ce5765996f1d8c56..939050169d122c9d129219be27c09e6a9a9ef443 100644 (file)
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2335,12 +2335,9 @@ static unsigned long get_segment_base(unsigned int segment)
 #ifdef CONFIG_MODIFY_LDT_SYSCALL
                struct ldt_struct *ldt;
 
-               if (idx > LDT_ENTRIES)
-                       return 0;
-
                /* IRQs are off, so this synchronizes with smp_store_release */
                ldt = lockless_dereference(current->active_mm->context.ldt);
-               if (!ldt || idx > ldt->nr_entries)
+               if (!ldt || idx >= ldt->nr_entries)
                        return 0;
 
                desc = &ldt->entries[idx];
@@ -2348,7 +2345,7 @@ static unsigned long get_segment_base(unsigned int segment)
                return 0;
 #endif
        } else {
-               if (idx > GDT_ENTRIES)
+               if (idx >= GDT_ENTRIES)
                        return 0;
 
                desc = raw_cpu_ptr(gdt_page.gdt) + idx;