scsi: ufs: mediatek: Fix out-of-bounds access in MCQ IRQ mapping

Address a potential out-of-bounds access issue when accessing
'host->mcq_intr_info[q_index]'. The value of 'q_index' might exceed the
valid array bounds if 'q_index == nr'.  Correct condition to 'q_index >=
nr' to prevent accessing invalid memory.

Fixes: 66e26a4b8a77 ("scsi: ufs: host: mediatek: Set IRQ affinity policy for MCQ mode")
Cc: stable@vger.kernel.org
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20250804060249.1387057-1-peter.wang@mediatek.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
index 86ae73b89d4d632db5e4dc55a8f8bf84b06b6a88..f902ce08c95a627c358c3ebca1eea013b8477dcf 100644 (file)
--- a/drivers/ufs/host/ufs-mediatek.c
+++ b/drivers/ufs/host/ufs-mediatek.c
@@ -818,7 +818,7 @@ static u32 ufs_mtk_mcq_get_irq(struct ufs_hba *hba, unsigned int cpu)
        unsigned int q_index;
 
        q_index = map->mq_map[cpu];
-       if (q_index > nr) {
+       if (q_index >= nr) {
                dev_err(hba->dev, "hwq index %d exceed %d\n",
                        q_index, nr);
                return MTK_MCQ_INVALID_IRQ;