Commit 0926f910 authored Oct 25, 2010 by Eli Cohen Committed by David S. Miller Oct 25, 2010

mlx4_en: Fix out of bounds array access



When searching for a free entry in either mlx4_register_vlan() or
mlx4_register_mac(), and there is no free entry, the loop terminates without
updating the local variable free thus causing out of array bounds access. Fix
this by adding a proper check outside the loop.

Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent b336369c

drivers/net/mlx4/port.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -111,6 +111,12 @@ int mlx4_register_mac(struct mlx4_dev dev, u8 port, u64 mac, int index)
		goto out;
		}
		}

		if (free < 0) {
		err = -ENOMEM;
		goto out;
		}

		mlx4_dbg(dev, "Free MAC index is %d\n", free);

		if (table->total == table->max) {
		@@ -205,6 +211,11 @@ int mlx4_register_vlan(struct mlx4_dev dev, u8 port, u16 vlan, int index)
		}
		}

		if (free < 0) {
		err = -ENOMEM;
		goto out;
		}

		if (table->total == table->max) {
		/* No free vlan entries */
		err = -ENOSPC;