summaryrefslogtreecommitdiff
path: root/drivers/net/ethernet
diff options
context:
space:
mode:
authorManish Chopra <manish.chopra@qlogic.com>2014-01-28 11:55:27 -0500
committerDavid S. Miller <davem@davemloft.net>2014-01-28 11:59:30 -0800
commit462bed4870a813bb3ab33254de70757a92d0dc69 (patch)
tree87254d559c318d48ae446015a228983089b097ae /drivers/net/ethernet
parentd922e1cb1ea17ac7f0a5c3c2be98d4bd80d055b8 (diff)
qlcnic: Correct off-by-one errors in bounds checks
o Bound checks should be >= instead of > for number of receive descriptors and number of receive rings. Signed-off-by: Manish Chopra <manish.chopra@qlogic.com> Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet')
-rw-r--r--drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 30874cda8476..19e1a93bac67 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -1150,13 +1150,13 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
u16 lro_length, length, data_offset, t_vid, vid = 0xffff;
u32 seq_number;
- if (unlikely(ring > adapter->max_rds_rings))
+ if (unlikely(ring >= adapter->max_rds_rings))
return NULL;
rds_ring = &recv_ctx->rds_rings[ring];
index = qlcnic_get_lro_sts_refhandle(sts_data0);
- if (unlikely(index > rds_ring->num_desc))
+ if (unlikely(index >= rds_ring->num_desc))
return NULL;
buffer = &rds_ring->rx_buf_arr[index];
@@ -1662,13 +1662,13 @@ qlcnic_83xx_process_lro(struct qlcnic_adapter *adapter,
u16 vid = 0xffff;
int err;
- if (unlikely(ring > adapter->max_rds_rings))
+ if (unlikely(ring >= adapter->max_rds_rings))
return NULL;
rds_ring = &recv_ctx->rds_rings[ring];
index = qlcnic_83xx_hndl(sts_data[0]);
- if (unlikely(index > rds_ring->num_desc))
+ if (unlikely(index >= rds_ring->num_desc))
return NULL;
buffer = &rds_ring->rx_buf_arr[index];