git: ee01a1e7d862 - stable/12 - mpr, mps: Fix an off-by-one bug in the BTDH_MAPPING ioctl

[Mark Johnston]

The branch stable/12 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=ee01a1e7d862a5a33b43b8ae9da220d83f089c21

commit ee01a1e7d862a5a33b43b8ae9da220d83f089c21
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-01-08 18:32:05 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-01-11 14:43:17 +0000

    mpr, mps: Fix an off-by-one bug in the BTDH_MAPPING ioctl
    
    The device mapping table contains sc->max_devices entries, so only
    indices in [0, sc->max_devices) are valid.
    
    Differential Revision:  https://reviews.freebsd.org/D27964
    
    (cherry picked from commit adc0dcc352bb9f5a67a054d95c6959ea5aa26d91)
---
 sys/dev/mpr/mpr_user.c | 2 +-
 sys/dev/mps/mps_user.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/dev/mpr/mpr_user.c b/sys/dev/mpr/mpr_user.c
index 9bcc7f78da0f..1b2aa398b22b 100644
--- a/sys/dev/mpr/mpr_user.c
+++ b/sys/dev/mpr/mpr_user.c
@@ -2232,7 +2232,7 @@ mpr_user_btdh(struct mpr_softc *sc, mpr_btdh_mapping_t *data)
 		if (bus != 0)
 			return (EINVAL);
 
-		if (target > sc->max_devices) {
+		if (target >= sc->max_devices) {
 			mpr_dprint(sc, MPR_XINFO, "Target ID is out of range "
 			   "for Bus/Target to DevHandle mapping.");
 			return (EINVAL);
diff --git a/sys/dev/mps/mps_user.c b/sys/dev/mps/mps_user.c
index 15ae463a1ad1..af1526c36d4c 100644
--- a/sys/dev/mps/mps_user.c
+++ b/sys/dev/mps/mps_user.c
@@ -2135,7 +2135,7 @@ mps_user_btdh(struct mps_softc *sc, mps_btdh_mapping_t *data)
 		if (bus != 0)
 			return (EINVAL);
 
-		if (target > sc->max_devices) {
+		if (target >= sc->max_devices) {
 			mps_dprint(sc, MPS_FAULT, "Target ID is out of range "
 			   "for Bus/Target to DevHandle mapping.");
 			return (EINVAL);