diff options
| author | Roland Dreier <rolandd@cisco.com> | 2007-05-19 17:51:58 +0200 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2007-05-19 17:51:58 +0200 |
| commit | 59b0ed121297b57abb2352bdc8313959e7cb5635 (patch) | |
| tree | 560ade0adc4a3ccf88336ee88fea0f079868862a /drivers | |
| parent | mlx4_core: Fix array overrun in dump_dev_cap_flags() (diff) | |
| download | linux-59b0ed121297b57abb2352bdc8313959e7cb5635.tar.xz linux-59b0ed121297b57abb2352bdc8313959e7cb5635.zip | |
IB/mlx4: Fix check of opcode in mlx4_ib_post_send()
wr->opcode is invalid if it's >= ARRAY_SIZE(mlx4_ib_opcode), not just
strictly >.
This was spotted by the Coverity checker (CID 1643).
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/hw/mlx4/qp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c index bd28af5753d1..5706f988e2ec 100644 --- a/drivers/infiniband/hw/mlx4/qp.c +++ b/drivers/infiniband/hw/mlx4/qp.c @@ -1238,7 +1238,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, */ wmb(); - if (wr->opcode < 0 || wr->opcode > ARRAY_SIZE(mlx4_ib_opcode)) { + if (wr->opcode < 0 || wr->opcode >= ARRAY_SIZE(mlx4_ib_opcode)) { err = -EINVAL; goto out; } |