[PATCH 2/2] net: ethernet: cpsw: fix interrupt lookup logic in cpsw_probe()

[Daniel Mack <zonque@gmail.com>]

The code in cpsw_probe() currently iterates over the available
interrupt resources and requests each of them.  While doing so, it
keeps track of their indices through priv->irqs_table.

However, the code currently only remembers the last interrupt in
a resource, and will leak the others if there is more than one.
This can only happen for board-file driven platforms and not via DT,
however.

Also, there is currently no bounds check, while priv->irqs_table is a
fixed-size array. If we are passed more than 4 resources, we're in
trouble.

This patch introduces a bounds check and changes the way interrupt
indices are kept. Tested on a Beagle Bone Black board only.

Signed-off-by: Daniel Mack <zonque@gmail.com>
---
 drivers/net/ethernet/ti/cpsw.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index cdbbb58..e747e55 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2233,13 +2233,18 @@ static int cpsw_probe(struct platform_device *pdev)
 
 	while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
 		for (i = res->start; i <= res->end; i++) {
+			if (priv->num_irqs >= ARRAY_SIZE(priv->irqs_table)) {
+				ret = -EINVAL;
+				goto clean_irq_ret;
+			}
+
 			if (request_irq(i, cpsw_interrupt, 0,
 					dev_name(&pdev->dev), priv)) {
 				dev_err(priv->dev, "error attaching irq\n");
 				goto clean_irq_ret;
 			}
-			priv->irqs_table[k] = i;
-			priv->num_irqs = k + 1;
+			priv->irqs_table[priv->num_irqs] = i;
+			priv->num_irqs++;
 		}
 		k++;
 	}
-- 
2.1.0