Skip to contentSkip to conversation

ath9k/htc_drv_main: off by one error

PATCH In review Dan Carpenter 2 participants 2 messages May 8, 2010 – May 10, 2010 Qualcomm Atheros ATH9K wireless driver

lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 5/9 ath9k/htc_drv_main: off by one error

I changed "> ATH9K_HTC_MAX_TID" to ">= ATH9K_HTC_MAX_TID" to avoid a potential overflow.

Signed-off-by Dan Carpenter <[email protected]>
drivers/net/wireless/ath/ath9k/htc_drv_main.c +1 -1
index e75db06..6c386da 100644
@@ -465,7 +465,7 @@ static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
 	int ret = 0;
 	u8 cmd_rsp;
 
-	if (tid > ATH9K_HTC_MAX_TID)
+	if (tid >= ATH9K_HTC_MAX_TID)
 		return -EINVAL;
 
 	memset(&aggr, 0, sizeof(struct ath9k_htc_target_aggr));
#1 lore raw

PATCH 5/9 ath9k/htc_drv_main: off by one error

Quoted 4 lines · Dan Carpenter

I changed "> ATH9K_HTC_MAX_TID" to ">= ATH9K_HTC_MAX_TID" to avoid a potential overflow.

Signed-off-by Dan Carpenter <[email protected]>

Thanks.

Acked-by Sujith <[email protected]>
Quoted 13 lines
drivers/net/wireless/ath/ath9k/htc_drv_main.c +1 -1
index e75db06..6c386da 100644
@@ -465,7 +465,7 @@ static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
 	int ret = 0;
 	u8 cmd_rsp;
 
-	if (tid > ATH9K_HTC_MAX_TID)
+	if (tid >= ATH9K_HTC_MAX_TID)
 		return -EINVAL;
 
 	memset(&aggr, 0, sizeof(struct ath9k_htc_target_aggr));