From a2b5fd298130ad38d61c3fff1a6aa7dd0c1d02ea Mon Sep 17 00:00:00 2001 From: Martin Kaiser Date: Fri, 22 Apr 2022 16:09:58 +0200 Subject: [PATCH] staging: r8188eu: fix the index check in mgt_dispatcher In mgt_dispatcher, we check that index is a valid index for the mlme_sta_tbl array. The valid indices for this array are from 0 to ARRAY_SIZE(mlme_sta_tbl) - 1. An invalid index is >= ARRAY_SIZE(mlme_sta_tbl). Fix the off by one error in the check. Fixes: db84803cd8de ("staging: r8188eu: use ARRAY_SIZE for mlme_sta_tbl") Reported-by: Dan Carpenter Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220422140958.239767-1-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman --- drivers/staging/r8188eu/core/rtw_mlme_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/r8188eu/core/rtw_mlme_ext.c b/drivers/staging/r8188eu/core/rtw_mlme_ext.c index 935f145ca18b..7739a0bde1e0 100644 --- a/drivers/staging/r8188eu/core/rtw_mlme_ext.c +++ b/drivers/staging/r8188eu/core/rtw_mlme_ext.c @@ -398,7 +398,7 @@ void mgt_dispatcher(struct adapter *padapter, struct recv_frame *precv_frame) return; index = (le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_STYPE) >> 4; - if (index > ARRAY_SIZE(mlme_sta_tbl)) + if (index >= ARRAY_SIZE(mlme_sta_tbl)) return; fct = mlme_sta_tbl[index];