[PATCH] checker bounds/limits fixes

Part of the bounds checking bugs found by the Stanford checker.

The 4 fixes below have been acked by their maintainers.

drivers/char/rio/rioroute.c

@@ -763,7 +763,7 @@ uint UnitId;
 #endif
 	UnitId--;		/* this trick relies on the Unit Id being UNSIGNED! */
 
-	if ( UnitId > MAX_RUP )		/* dontcha just lurv unsigned maths! */
+	if ( UnitId >= MAX_RUP )	/* dontcha just lurv unsigned maths! */
 		return(0);
 
 	if ( HostP->Mapping[UnitId].Flags & BEEN_HERE )

drivers/char/specialix.c

@@ -1456,7 +1456,7 @@ static int sx_open(struct tty_struct * tty, struct file * filp)
 	
 	board = SX_BOARD(minor(tty->device));
 
-	if (board > SX_NBOARD || !(sx_board[board].flags & SX_BOARD_PRESENT))
+	if (board >= SX_NBOARD || !(sx_board[board].flags & SX_BOARD_PRESENT))
 		return -ENODEV;
 	
 	bp = &sx_board[board];
@@ -2363,7 +2363,7 @@ int specialix_init(void)
 		struct pci_dev *pdev = NULL;
 
 		i=0;
-		while (i <= SX_NBOARD) {
+		while (i < SX_NBOARD) {
 			if (sx_board[i].flags & SX_BOARD_PRESENT) {
 				i++;
 				continue;

net/bluetooth/af_bluetooth.c

@@ -92,7 +92,7 @@ int bt_sock_unregister(int proto)
 
 static int bt_sock_create(struct socket *sock, int proto)
 {
-	if (proto > BT_MAX_PROTO)
+	if (proto >= BT_MAX_PROTO)
 		return -EINVAL;
 
 #if defined(CONFIG_KMOD)

net/core/rtnetlink.c

@@ -351,7 +351,7 @@ rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp)
 		return 0;
 
 	family = ((struct rtgenmsg*)NLMSG_DATA(nlh))->rtgen_family;
-	if (family > NPROTO) {
+	if (family >= NPROTO) {
 		*errp = -EAFNOSUPPORT;
 		return -1;
 	}