From: Dan Carpenter <dan.carpenter@oracle.com>
To: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: Rajesh Borundia <rajesh.borundia@qlogic.com>,
Shahed Shaikh <shahed.shaikh@qlogic.com>,
Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>,
Sony Chacko <sony.chacko@qlogic.com>,
Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>,
linux-driver@qlogic.com, netdev@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: [patch -next] qlcnic: underflow in qlcnic_validate_max_tx_rings()
Date: Tue, 27 Aug 2013 04:16:22 +0300 [thread overview]
Message-ID: <20130827011622.GB17061@elgon.mountain> (raw)
This function checks the upper bound but it doesn't check for negative
numbers:
if (txq > QLCNIC_MAX_TX_RINGS) {
I've solved this by making "txq" a u32 type. I chose that because
->tx_count in the ethtool_channels struct is a __u32.
This bug was added in aa4a1f7df7 ('qlcnic: Enable Tx queue changes using
ethtool for 82xx Series adapter.').
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 3f03856..ae9b444 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1537,7 +1537,7 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test);
netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
int qlcnic_set_max_rss(struct qlcnic_adapter *, u8, int);
int qlcnic_validate_max_rss(struct qlcnic_adapter *, __u32);
-int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *, int);
+int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *, u32 txq);
void qlcnic_alloc_lb_filters_mem(struct qlcnic_adapter *adapter);
void qlcnic_82xx_set_mac_filter_count(struct qlcnic_adapter *);
int qlcnic_enable_msix(struct qlcnic_adapter *, u32);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 8321d1a..88e3c97 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -3524,7 +3524,7 @@ qlcnicvf_start_firmware(struct qlcnic_adapter *adapter)
return err;
}
-int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *adapter, int txq)
+int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *adapter, u32 txq)
{
struct net_device *netdev = adapter->netdev;
u8 max_hw = QLCNIC_MAX_TX_RINGS;
next reply other threads:[~2013-08-27 1:16 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-27 1:16 Dan Carpenter [this message]
2013-08-27 4:25 ` [patch -next] qlcnic: underflow in qlcnic_validate_max_tx_rings() Himanshu Madhani
2013-08-27 4:40 ` Himanshu Madhani
2013-08-29 5:24 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130827011622.GB17061@elgon.mountain \
--to=dan.carpenter@oracle.com \
--cc=himanshu.madhani@qlogic.com \
--cc=jitendra.kalsaria@qlogic.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-driver@qlogic.com \
--cc=netdev@vger.kernel.org \
--cc=rajesh.borundia@qlogic.com \
--cc=shahed.shaikh@qlogic.com \
--cc=sony.chacko@qlogic.com \
--cc=sucheta.chakraborty@qlogic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox