linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc()
@ 2017-04-21 19:46 Dan Carpenter
  2017-04-21 19:59 ` Johannes Berg
  0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2017-04-21 19:46 UTC (permalink / raw)
  To: Johannes Berg, Sara Sharon
  Cc: Emmanuel Grumbach, Luca Coelho, Intel Linux Wireless, Kalle Valo,
	linux-wireless, kernel-janitors

The > should be >= or we are writing one space beyond the end of the
array.

Fixes: 310181ec34e2 ("iwlwifi: move to TVQM mode")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..295331558108 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -912,7 +912,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
 	rsp = (void *)hcmd.resp_pkt->data;
 	qid = le16_to_cpu(rsp->queue_number);
 
-	if (qid > ARRAY_SIZE(trans_pcie->txq)) {
+	if (qid >= ARRAY_SIZE(trans_pcie->txq)) {
 		WARN_ONCE(1, "queue index %d unsupported", qid);
 		ret = -EIO;
 		goto error;

^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2017-04-22  9:43 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-04-21 19:46 [PATCH] iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc() Dan Carpenter
2017-04-21 19:59 ` Johannes Berg
2017-04-21 20:12   ` Dan Carpenter
2017-04-22  7:02     ` Coelho, Luciano
2017-04-22  9:42       ` Dan Carpenter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).