mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 00:39:48 +00:00
RDMA/bnxt_re: Fix a couple off by one bugs
[ Upstream commit474e5a8606
] The sgid_tbl->tbl[] array is allocated in bnxt_qplib_alloc_sgid_tbl(). It has sgid_tbl->max elements. So the > should be >= to prevent accessing one element beyond the end of the array. Fixes:1ac5a40479
("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
e0ccd2360a
commit
e862ab6b69
1 changed files with 2 additions and 2 deletions
|
@ -156,7 +156,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res,
|
|||
struct bnxt_qplib_sgid_tbl *sgid_tbl, int index,
|
||||
struct bnxt_qplib_gid *gid)
|
||||
{
|
||||
if (index > sgid_tbl->max) {
|
||||
if (index >= sgid_tbl->max) {
|
||||
dev_err(&res->pdev->dev,
|
||||
"QPLIB: Index %d exceeded SGID table max (%d)",
|
||||
index, sgid_tbl->max);
|
||||
|
@ -361,7 +361,7 @@ int bnxt_qplib_get_pkey(struct bnxt_qplib_res *res,
|
|||
*pkey = 0xFFFF;
|
||||
return 0;
|
||||
}
|
||||
if (index > pkey_tbl->max) {
|
||||
if (index >= pkey_tbl->max) {
|
||||
dev_err(&res->pdev->dev,
|
||||
"QPLIB: Index %d exceeded PKEY table max (%d)",
|
||||
index, pkey_tbl->max);
|
||||
|
|
Loading…
Reference in a new issue