sdma: fix off-by-one in the event bound check

lrgirdwo · lgirdwood · commit f58d583cd6ca · 2026-06-18T13:15:39.000+01:00
The event-number range check used a strict greater-than against the
event count, allowing the count value itself to index one past the
array. Use greater-or-equal, in both the enable and disable paths.

Signed-off-by: Liam Girdwood &lt;liam.r.girdwood@linux.intel.com&gt;
diff --git a/src/drivers/imx/sdma.c b/src/drivers/imx/sdma.c
@@ -443,7 +443,7 @@ static void sdma_enable_event(struct dma_chan_data *channel, int eventnum)
 
 	tr_dbg(&sdma_tr, "channel %d, event %d", channel->index, eventnum);
 
-	if (eventnum < 0 || eventnum > SDMA_HWEVENTS_COUNT)
+	if (eventnum < 0 || eventnum >= SDMA_HWEVENTS_COUNT)
 		return; /* No change if request is invalid */
 
 	dma_reg_update_bits(channel->dma, SDMA_CHNENBL(eventnum),
@@ -461,7 +461,7 @@ static void sdma_disable_event(struct dma_chan_data *channel, int eventnum)
 {
 	tr_dbg(&sdma_tr, "channel %d, event %d", channel->index, eventnum);
 
-	if (eventnum < 0 || eventnum > SDMA_HWEVENTS_COUNT)
+	if (eventnum < 0 || eventnum >= SDMA_HWEVENTS_COUNT)
 		return; /* No change if request is invalid */
 
 	dma_reg_update_bits(channel->dma, SDMA_CHNENBL(eventnum),
