diff options
| author | Roland Dreier <rolandd@cisco.com> | 2007-05-19 08:51:58 -0700 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2007-05-19 08:51:58 -0700 |
| commit | 59b0ed121297b57abb2352bdc8313959e7cb5635 (patch) | |
| tree | 560ade0adc4a3ccf88336ee88fea0f079868862a /drivers | |
| parent | 23c15c21d34a4b4b4d7b9a95ce498991c5339c77 (diff) | |
| download | op-kernel-dev-59b0ed121297b57abb2352bdc8313959e7cb5635.zip op-kernel-dev-59b0ed121297b57abb2352bdc8313959e7cb5635.tar.gz | |
IB/mlx4: Fix check of opcode in mlx4_ib_post_send()
wr->opcode is invalid if it's >= ARRAY_SIZE(mlx4_ib_opcode), not just
strictly >.
This was spotted by the Coverity checker (CID 1643).
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/hw/mlx4/qp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c index bd28af5..5706f98 100644 --- a/drivers/infiniband/hw/mlx4/qp.c +++ b/drivers/infiniband/hw/mlx4/qp.c @@ -1238,7 +1238,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, */ wmb(); - if (wr->opcode < 0 || wr->opcode > ARRAY_SIZE(mlx4_ib_opcode)) { + if (wr->opcode < 0 || wr->opcode >= ARRAY_SIZE(mlx4_ib_opcode)) { err = -EINVAL; goto out; } |
