diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-04-17 20:53:42 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-04-19 15:22:44 -0400 |
| commit | 7e5998aa74065d3ab31d17e667f40ffebf4b8425 (patch) | |
| tree | fd29b26607e2e7be259c8ddf3e11e932bfdfa13e | |
| parent | 716af4abd6e6370226f567af50bfaca274515980 (diff) | |
| download | op-kernel-dev-7e5998aa74065d3ab31d17e667f40ffebf4b8425.zip op-kernel-dev-7e5998aa74065d3ab31d17e667f40ffebf4b8425.tar.gz | |
bnx2x: off by one in bnx2x_ets_e3b0_sp_pri_to_cos_set()
The sp_pri_to_cos[] array size depends on the config but lets say it is
BX_E3B0_MAX_NUM_COS_PORT0 and max_num_of_cos is also
DCBX_E3B0_MAX_NUM_COS_PORT0. In the original code
"pri == max_num_of_cos" was accepted but it is one past the end of the
array.
Also we used "pri" before capping it. It's a harmless read past the end
of the array, but it would affect which error message gets printed.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c index ad95324..64392ec 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c @@ -942,6 +942,12 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params, const u8 max_num_of_cos = (port) ? DCBX_E3B0_MAX_NUM_COS_PORT1 : DCBX_E3B0_MAX_NUM_COS_PORT0; + if (pri >= max_num_of_cos) { + DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid " + "parameter Illegal strict priority\n"); + return -EINVAL; + } + if (sp_pri_to_cos[pri] != DCBX_INVALID_COS) { DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid " "parameter There can't be two COS's with " @@ -949,12 +955,6 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params, return -EINVAL; } - if (pri > max_num_of_cos) { - DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid " - "parameter Illegal strict priority\n"); - return -EINVAL; - } - sp_pri_to_cos[pri] = cos_entry; return 0; |
