Re: [PATCH] iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc()

[Coelho, Luciano]

On Fri, 2017-04-21 at 23:12 +0300, Dan Carpenter wrote:
> Heh.  I raced this one through to see if I could beat you to the punch.

Yeah, this patch is in our internal tree.  But maybe we can take Dan's
for upstream for his efforts? :)

--
Cheers,
Luca.

Re: [PATCH] iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc()

[Dan Carpenter]

Heh.  I raced this one through to see if I could beat you to the punch.

regards,
dan carpenter

[PATCH] iwlwifi: pcie: off by one in iwl_trans_pcie_dyn_txq_alloc()

[Dan Carpenter]

The > should be >= or we are writing one space beyond the end of the
array.

Fixes: 310181ec34e2 ("iwlwifi: move to TVQM mode")
Signed-off-by: Dan Carpenter 

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c 
b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..295331558108 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -912,7 +912,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
rsp = (void *)hcmd.resp_pkt->data;
qid = le16_to_cpu(rsp->queue_number);
 
-   if (qid > ARRAY_SIZE(trans_pcie->txq)) {
+   if (qid >= ARRAY_SIZE(trans_pcie->txq)) {
WARN_ONCE(1, "queue index %d unsupported", qid);
ret = -EIO;
goto error;