Commit 950e2958 authored by Wei Yang's avatar Wei Yang Committed by David S. Miller

be2net: bug fix on returning an invalid nic descriptor

In function be_get_nic_desc(), it will go through the descriptor array
returned from f/w. By comparing the desc_type field, it determines whether
there is a nic descriptor in the array or not. In the case of no nic
descriptor, this function should return NULL.

The code may return an invalide descriptor, when there is no nic descriptor
in the array and the desc_count is less than MAX_RESOURCE_DESC. In this case,
even there is no nic descriptor, it will still return the lase descriptor
since the i doesn't equal to MAX_RESOURCE_DESC.

This patch fix this issue by returning the descriptor when find it and return
NULL for other cases.
Signed-off-by: default avatarWei Yang <weiyang@linux.vnet.ibm.com>
Reviewed-by: default avatarGavin Shan <shangw@linux.vnet.ibm.com>
Reviewed-by: default avatarXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Acked-by: default avatarSathya Perla <sathya.perla@emulex.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 547669d4
...@@ -2976,22 +2976,17 @@ static struct be_nic_resource_desc *be_get_nic_desc(u8 *buf, u32 desc_count, ...@@ -2976,22 +2976,17 @@ static struct be_nic_resource_desc *be_get_nic_desc(u8 *buf, u32 desc_count,
for (i = 0; i < desc_count; i++) { for (i = 0; i < desc_count; i++) {
desc->desc_len = desc->desc_len ? : RESOURCE_DESC_SIZE; desc->desc_len = desc->desc_len ? : RESOURCE_DESC_SIZE;
if (((void *)desc + desc->desc_len) > if (((void *)desc + desc->desc_len) >
(void *)(buf + max_buf_size)) { (void *)(buf + max_buf_size))
desc = NULL; return NULL;
break;
}
if (desc->desc_type == NIC_RESOURCE_DESC_TYPE_V0 || if (desc->desc_type == NIC_RESOURCE_DESC_TYPE_V0 ||
desc->desc_type == NIC_RESOURCE_DESC_TYPE_V1) desc->desc_type == NIC_RESOURCE_DESC_TYPE_V1)
break; return desc;
desc = (void *)desc + desc->desc_len; desc = (void *)desc + desc->desc_len;
} }
if (!desc || i == MAX_RESOURCE_DESC) return NULL;
return NULL;
return desc;
} }
/* Uses Mbox */ /* Uses Mbox */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment