2010-05-08 16:24:17

by Dan Carpenter

Subject: [patch 5/9] ath9k/htc_drv_main: off by one error

I changed "> ATH9K_HTC_MAX_TID" to ">= ATH9K_HTC_MAX_TID" to avoid a
potential overflow.

Signed-off-by: Dan Carpenter <[email protected]>

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index e75db06..6c386da 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -465,7 +465,7 @@ static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
int ret = 0;
u8 cmd_rsp;

- if (tid > ATH9K_HTC_MAX_TID)
+ if (tid >= ATH9K_HTC_MAX_TID)
return -EINVAL;

memset(&aggr, 0, sizeof(struct ath9k_htc_target_aggr));

2010-05-10 04:38:47

by Sujith

Subject: [patch 5/9] ath9k/htc_drv_main: off by one error

Dan Carpenter wrote:
> I changed "> ATH9K_HTC_MAX_TID" to ">= ATH9K_HTC_MAX_TID" to avoid a
> potential overflow.
>
> Signed-off-by: Dan Carpenter <[email protected]>

Thanks.

Acked-by: Sujith <[email protected]>

> diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
> index e75db06..6c386da 100644
> --- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
> +++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
> @@ -465,7 +465,7 @@ static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
> int ret = 0;
> u8 cmd_rsp;
>
> - if (tid > ATH9K_HTC_MAX_TID)
> + if (tid >= ATH9K_HTC_MAX_TID)
> return -EINVAL;
>
> memset(&aggr, 0, sizeof(struct ath9k_htc_target_aggr));