iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc()

Commit Message

Dan Carpenter April 21, 2017, 7:46 p.m. UTC

The > should be >= or we are writing one space beyond the end of the
array.

Fixes: 310181ec34e2 ("iwlwifi: move to TVQM mode")
Signed-off-by: Dan Carpenter <[e-mail]>

Comments

Johannes Berg April 21, 2017, 7:59 p.m. UTC | #1

On Fri, 2017-04-21 at 22:46 +0300, Dan Carpenter wrote:
> The > should be >= or we are writing one space beyond the end of the
> array.

I think I just did the same fixes you did - after running smatch :)

This is on its way already (in our local tree), but since nobody can
actually run the code yet - the hardware doesn't exist - Luca hasn't
sent it out yet.

Thanks though!

johannes

Dan Carpenter April 21, 2017, 8:12 p.m. UTC | #2

Heh.  I raced this one through to see if I could beat you to the punch.

regards,
dan carpenter

Coelho, Luciano April 22, 2017, 7:02 a.m. UTC | #3

On Fri, 2017-04-21 at 23:12 +0300, Dan Carpenter wrote:
> Heh.  I raced this one through to see if I could beat you to the punch.


Yeah, this patch is in our internal tree.  But maybe we can take Dan's
for upstream for his efforts? :)

--
Cheers,
Luca.

Dan Carpenter April 22, 2017, 9:42 a.m. UTC | #4

On Sat, Apr 22, 2017 at 07:02:23AM +0000, Coelho, Luciano wrote:
> On Fri, 2017-04-21 at 23:12 +0300, Dan Carpenter wrote:
> > Heh.  I raced this one through to see if I could beat you to the punch.
> 
> Yeah, this patch is in our internal tree.  But maybe we can take Dan's
> for upstream for his efforts? :)

No no.

regards,
dan carpenter

Patch

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..295331558108 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -912,7 +912,7 @@  int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
 	rsp = (void *)hcmd.resp_pkt->data;
 	qid = le16_to_cpu(rsp->queue_number);
 
-	if (qid > ARRAY_SIZE(trans_pcie->txq)) {
+	if (qid >= ARRAY_SIZE(trans_pcie->txq)) {
 		WARN_ONCE(1, "queue index %d unsupported", qid);
 		ret = -EIO;
 		goto error;