Commit 80b17be7 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

qlcnic: underflow in qlcnic_validate_max_tx_rings()

This function checks the upper bound but it doesn't check for negative
numbers:

	if (txq > QLCNIC_MAX_TX_RINGS) {

I've solved this by making "txq" a u32 type.  I chose that because
->tx_count in the ethtool_channels struct is a __u32.

This bug was added in aa4a1f7d ('qlcnic: Enable Tx queue changes using
ethtool for 82xx Series adapter.').
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarHimanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 823a19e0
...@@ -1542,7 +1542,7 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test); ...@@ -1542,7 +1542,7 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test);
netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev); netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
int qlcnic_set_max_rss(struct qlcnic_adapter *, u8, int); int qlcnic_set_max_rss(struct qlcnic_adapter *, u8, int);
int qlcnic_validate_max_rss(struct qlcnic_adapter *, __u32); int qlcnic_validate_max_rss(struct qlcnic_adapter *, __u32);
int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *, int); int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *, u32 txq);
void qlcnic_alloc_lb_filters_mem(struct qlcnic_adapter *adapter); void qlcnic_alloc_lb_filters_mem(struct qlcnic_adapter *adapter);
void qlcnic_82xx_set_mac_filter_count(struct qlcnic_adapter *); void qlcnic_82xx_set_mac_filter_count(struct qlcnic_adapter *);
int qlcnic_enable_msix(struct qlcnic_adapter *, u32); int qlcnic_enable_msix(struct qlcnic_adapter *, u32);
......
...@@ -3548,7 +3548,7 @@ qlcnicvf_start_firmware(struct qlcnic_adapter *adapter) ...@@ -3548,7 +3548,7 @@ qlcnicvf_start_firmware(struct qlcnic_adapter *adapter)
return err; return err;
} }
int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *adapter, int txq) int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *adapter, u32 txq)
{ {
struct net_device *netdev = adapter->netdev; struct net_device *netdev = adapter->netdev;
u8 max_hw = QLCNIC_MAX_TX_RINGS; u8 max_hw = QLCNIC_MAX_TX_RINGS;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment