Commit e862ab6b authored Jul 04, 2018 by Dan Carpenter Committed by Greg Kroah-Hartman Oct 03, 2018

RDMA/bnxt_re: Fix a couple off by one bugs



[ Upstream commit 474e5a86067e5f12c97d1db8b170c7f45b53097a ]

The sgid_tbl->tbl[] array is allocated in bnxt_qplib_alloc_sgid_tbl().
It has sgid_tbl->max elements.  So the > should be >= to prevent
accessing one element beyond the end of the array.

Fixes: 1ac5a404 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent e0ccd236

drivers/infiniband/hw/bnxt_re/qplib_sp.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -156,7 +156,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res,
		struct bnxt_qplib_sgid_tbl *sgid_tbl, int index,
		struct bnxt_qplib_gid *gid)
		{
		if (index > sgid_tbl->max) {
		if (index >= sgid_tbl->max) {
		dev_err(&res->pdev->dev,
		"QPLIB: Index %d exceeded SGID table max (%d)",
		index, sgid_tbl->max);
		@@ -361,7 +361,7 @@ int bnxt_qplib_get_pkey(struct bnxt_qplib_res *res,
		*pkey = 0xFFFF;
		return 0;
		}
		if (index > pkey_tbl->max) {
		if (index >= pkey_tbl->max) {
		dev_err(&res->pdev->dev,
		"QPLIB: Index %d exceeded PKEY table max (%d)",
		index, pkey_tbl->max);