The ->nr_signal is the supposed to be the number of elements in the
->signal array.  There was one place where it was 5 but it was supposed
to be 4.  That looks like a copy and paste bug.  There were also two
checks that were off by one.
Fixes: 9e2c2e273012 ("drm/etnaviv: add infrastructure to query perf counter")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Tested-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
                .name = "PE",
                .profile_read = VIVS_MC_PROFILE_PE_READ,
                .profile_config = VIVS_MC_PROFILE_CONFIG0,
-               .nr_signals = 5,
+               .nr_signals = 4,
                .signal = (const struct etnaviv_pm_signal[]) {
                        {
                                "PIXEL_COUNT_KILLED_BY_COLOR_PIPE",
 
        dom = meta->domains + signal->domain;
 
-       if (signal->iter > dom->nr_signals)
+       if (signal->iter >= dom->nr_signals)
                return -EINVAL;
 
        sig = &dom->signal[signal->iter];
 
        dom = meta->domains + r->domain;
 
-       if (r->signal > dom->nr_signals)
+       if (r->signal >= dom->nr_signals)
                return -EINVAL;
 
        return 0;