Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e5998aa authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

bnx2x: off by one in bnx2x_ets_e3b0_sp_pri_to_cos_set() 



The sp_pri_to_cos[] array size depends on the config but lets say it is
BX_E3B0_MAX_NUM_COS_PORT0 and max_num_of_cos is also
DCBX_E3B0_MAX_NUM_COS_PORT0.  In the original code
"pri == max_num_of_cos" was accepted but it is one past the end of the
array.

Also we used "pri" before capping it.  It's a harmless read past the end
of the array, but it would affect which error message gets printed.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarEilon Greenstein <eilong@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 716af4ab

drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c

+6 −6
Original line number Diff line number Diff line
@@ -942,16 +942,16 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params, 
	const u8 max_num_of_cos = (port) ? DCBX_E3B0_MAX_NUM_COS_PORT1 :

		DCBX_E3B0_MAX_NUM_COS_PORT0;



	if (sp_pri_to_cos[pri] != DCBX_INVALID_COS) {

	if (pri >= max_num_of_cos) {

		DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "

				   "parameter There can't be two COS's with "

				   "the same strict pri\n");

		   "parameter Illegal strict priority\n");

	    return -EINVAL;

	}



	if (pri > max_num_of_cos) {

	if (sp_pri_to_cos[pri] != DCBX_INVALID_COS) {

		DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "

		   "parameter Illegal strict priority\n");

				   "parameter There can't be two COS's with "

				   "the same strict pri\n");

		return -EINVAL;

	}