iwx(4): fix TID array index bound checks

[Stefan Sperling]

This tid variable is used as an array index and must thus be smaller
than MAX_TID_COUNT (which is 8).

The variable will be set to 8 if the AP wants us to use TID 8 for Rx agg,
which I've never seen happen in practice, though it is possible.

Our driver uses this value as an index into an array of
IEEE80211_NUM_TID (16) elements, and thus would not crash.

But the value is passed on to firmware which does who knows what with it.
The Linux driver uses this value as an index into an array ("tid_to_baid")
of MAX_TID_COUNT elements. Perhaps firmware has a similar limitation?
I cannot tell.
 
ok?
 
diff 0433237ad58131957ccba3ddd837ed772dbec416 
6629860d5767033824e2fb1c0f621c18216a7316
blob - 5cac83fd48ebe997a4cd7842730b0cb05f7c28ee
blob + 6e67f7db864ec9a7ca61057b7284e7d7a6bffe5d
--- sys/dev/pci/if_iwx.c
+++ sys/dev/pci/if_iwx.c
@@ -3264,7 +3264,7 @@ iwx_ampdu_rx_start(struct ieee80211com *ic, struct iee
        struct iwx_softc *sc = IC2IFP(ic)->if_softc;
 
        if (sc->sc_rx_ba_sessions >= IWX_MAX_RX_BA_SESSIONS ||
-           tid > IWX_MAX_TID_COUNT)
+           tid >= IWX_MAX_TID_COUNT)
                return ENOSPC;
 
        if (sc->ba_rx.start_tidmask & (1 << tid))
@@ -3286,7 +3286,7 @@ iwx_ampdu_rx_stop(struct ieee80211com *ic, struct ieee
 {
        struct iwx_softc *sc = IC2IFP(ic)->if_softc;
 
-       if (tid > IWX_MAX_TID_COUNT || sc->ba_rx.stop_tidmask & (1 << tid))
+       if (tid >= IWX_MAX_TID_COUNT || sc->ba_rx.stop_tidmask & (1 << tid))
                return;
 
        sc->ba_rx.stop_tidmask = (1 << tid);