Commit 2805557d authored Apr 23, 2017 by Pan Bian Committed by Greg Kroah-Hartman Mar 24, 2018

qlcnic: fix unchecked return value




[ Upstream commit 91ec701a553cb3de470fd471c6fefe3ad1125455 ]

Function pci_find_ext_capability() may return 0, which is an invalid
address. In function qlcnic_sriov_virtid_fn(), its return value is used
without validation. This may result in invalid memory access bugs. This
patch fixes the bug.

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 45250339

drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -126,6 +126,8 @@ static int qlcnic_sriov_virtid_fn(struct qlcnic_adapter *adapter, int vf_id)
	return 0;		return 0;

	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV);		pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV);
			if (!pos)
			return 0;
	pci_read_config_word(dev, pos + PCI_SRIOV_VF_OFFSET, &offset);		pci_read_config_word(dev, pos + PCI_SRIOV_VF_OFFSET, &offset);
	pci_read_config_word(dev, pos + PCI_SRIOV_VF_STRIDE, &stride);		pci_read_config_word(dev, pos + PCI_SRIOV_VF_STRIDE, &stride);