[PATCH 1/3] Bluetooth: btintel_pcie: Fix off-by-one bounds checks in synchronous paths

Fix two off-by-one errors where '>' should have been '>=' when
checking array indices against queue count:

1. btintel_pcie_send_sync(): tfd_index from tr_hia is used to index
   txq->tfds[] and txq->bufs[]. When tfd_index == txq->count (32),
   btintel_pcie_prepare_tx() writes past the end of both arrays.

2. btintel_pcie_submit_rx(): frbd_index from tr_hia is used to index
   rxq->frbds[] and rxq->bufs[]. When frbd_index == rxq->count (64),
   btintel_pcie_prepare_rx() writes past the end of both arrays.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: ZhaoJinming <[email protected]>
---
 drivers/bluetooth/btintel_pcie.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 2b7231be5973d399f7f2fde344032b2f3e394365..fe50c5699e12ef3819577e0f0bd1b79d4340bd9e 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -401,7 +401,7 @@ static int btintel_pcie_send_sync(struct btintel_pcie_data *data,
 
 	tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM];
 
-	if (tfd_index > txq->count)
+	if (tfd_index >= txq->count)
 		return -ERANGE;
 
 	/* Firmware raises alive interrupt on HCI_OP_RESET or
@@ -502,7 +502,7 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data)
 
 	frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM];
 
-	if (frbd_index > rxq->count)
+	if (frbd_index >= rxq->count)
 		return -ERANGE;
 
 	/* Prepare for RX submit. It updates the FRBD with the address of DMA

-- 
2.51.0