Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 474e5a86 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jason Gunthorpe
Browse files

RDMA/bnxt_re: Fix a couple off by one bugs 



The sgid_tbl->tbl[] array is allocated in bnxt_qplib_alloc_sgid_tbl().
It has sgid_tbl->max elements.  So the > should be >= to prevent
accessing one element beyond the end of the array.

Fixes: 1ac5a404 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarSelvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent c2d7c8ff

drivers/infiniband/hw/bnxt_re/qplib_sp.c

+2 −2
Original line number Diff line number Diff line
@@ -197,7 +197,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res, 
			struct bnxt_qplib_sgid_tbl *sgid_tbl, int index,

			struct bnxt_qplib_gid *gid)

{

	if (index > sgid_tbl->max) {

	if (index >= sgid_tbl->max) {

		dev_err(&res->pdev->dev,

			"QPLIB: Index %d exceeded SGID table max (%d)",

			index, sgid_tbl->max);
@@ -402,7 +402,7 @@ int bnxt_qplib_get_pkey(struct bnxt_qplib_res *res, 
		*pkey = 0xFFFF;

		return 0;

	}

	if (index > pkey_tbl->max) {

	if (index >= pkey_tbl->max) {

		dev_err(&res->pdev->dev,

			"QPLIB: Index %d exceeded PKEY table max (%d)",

			index, pkey_tbl->max);