svn commit: r304800 - head/sys/dev/syscons

[Bruce Evans]

Author: bde
Date: Thu Aug 25 12:04:57 2016
New Revision: 304800
URL: https://svnweb.freebsd.org/changeset/base/304800

Log:
  Fix logic errors in bounds checks in previous commit.  The 2-entry stack
  was overrun for grab levels larger than 2.
  
  Reported by:	pluknet

Modified:
  head/sys/dev/syscons/syscons.c

Modified: head/sys/dev/syscons/syscons.c
==============================================================================
--- head/sys/dev/syscons/syscons.c	Thu Aug 25 10:53:03 2016	(r304799)
+++ head/sys/dev/syscons/syscons.c	Thu Aug 25 12:04:57 2016	(r304800)
@@ -1729,7 +1729,7 @@ sc_cngrab(struct consdev *cp)
 
     sc = sc_console->sc;
     lev = atomic_fetchadd_int(&sc->grab_level, 1);
-    if (lev >= 0 || lev < 2)
+    if (lev >= 0 && lev < 2)
 	sccnopen(sc, &sc->grab_state[lev], 1 | 2);
 }
 
@@ -1741,7 +1741,7 @@ sc_cnungrab(struct consdev *cp)
 
     sc = sc_console->sc;
     lev = atomic_load_acq_int(&sc->grab_level) - 1;
-    if (lev >= 0 || lev < 2)
+    if (lev >= 0 && lev < 2)
 	sccnclose(sc, &sc->grab_state[lev]);
     atomic_add_int(&sc->grab_level, -1);
 }