[S390] qdio: fix access beyond ARRAY_SIZE of irq_ptr->{in,out}put_qs

Do not go beyond ARRAY_SIZE of irq_ptr->{in,out}put_qs

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index ba4facc37011e86402bc0526efb605185d0dbc66..d79cf5bf0e62312d98506ccb105618a640e64d09 100644 (file)
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1494,7 +1494,7 @@ int do_QDIO(struct ccw_device *cdev, unsigned int callflags,
 
        if ((bufnr > QDIO_MAX_BUFFERS_PER_Q) ||
            (count > QDIO_MAX_BUFFERS_PER_Q) ||
-           (q_nr > QDIO_MAX_QUEUES_PER_IRQ))
+           (q_nr >= QDIO_MAX_QUEUES_PER_IRQ))
                return -EINVAL;
 
        if (!count)