diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-07-04 12:57:11 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2018-07-04 21:06:26 +0300 |
| commit | 474e5a86067e5f12c97d1db8b170c7f45b53097a (patch) | |
| tree | 6b28c271b1213bf467efe1e607b40e0d97f46957 /drivers/infiniband/hw/bnxt_re/qplib_sp.c | |
| parent | c2d7c8ff89b22ddefb1ac2986c0d48444a667689 (diff) | |
| download | linux-474e5a86067e5f12c97d1db8b170c7f45b53097a.tar.xz | |
RDMA/bnxt_re: Fix a couple off by one bugs
The sgid_tbl->tbl[] array is allocated in bnxt_qplib_alloc_sgid_tbl().
It has sgid_tbl->max elements. So the > should be >= to prevent
accessing one element beyond the end of the array.
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/hw/bnxt_re/qplib_sp.c')
| -rw-r--r-- | drivers/infiniband/hw/bnxt_re/qplib_sp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c index 2f3f32eaa1d5..4097f3fa25c5 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c @@ -197,7 +197,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res, struct bnxt_qplib_sgid_tbl *sgid_tbl, int index, struct bnxt_qplib_gid *gid) { - if (index > sgid_tbl->max) { + if (index >= sgid_tbl->max) { dev_err(&res->pdev->dev, "QPLIB: Index %d exceeded SGID table max (%d)", index, sgid_tbl->max); @@ -402,7 +402,7 @@ int bnxt_qplib_get_pkey(struct bnxt_qplib_res *res, *pkey = 0xFFFF; return 0; } - if (index > pkey_tbl->max) { + if (index >= pkey_tbl->max) { dev_err(&res->pdev->dev, "QPLIB: Index %d exceeded PKEY table max (%d)", index, pkey_tbl->max); |