diff options
author | Eli Cohen <eli@dev.mellanox.co.il> | 2010-10-24 22:56:47 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2010-10-25 15:14:11 -0400 |
commit | 0926f91083f34d047abc74f1ca4fa6a9c161f7db (patch) | |
tree | 751135348a369dcdf85100b2cc7c7f8aefb508da /drivers/net/mlx4 | |
parent | b336369c1e1ad88495895260a9068eb18bc48b6c (diff) |
mlx4_en: Fix out of bounds array access
When searching for a free entry in either mlx4_register_vlan() or
mlx4_register_mac(), and there is no free entry, the loop terminates without
updating the local variable free thus causing out of array bounds access. Fix
this by adding a proper check outside the loop.
Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/mlx4')
-rw-r--r-- | drivers/net/mlx4/port.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/drivers/net/mlx4/port.c b/drivers/net/mlx4/port.c index 606aa58afde..8674ad5764c 100644 --- a/drivers/net/mlx4/port.c +++ b/drivers/net/mlx4/port.c | |||
@@ -111,6 +111,12 @@ int mlx4_register_mac(struct mlx4_dev *dev, u8 port, u64 mac, int *index) | |||
111 | goto out; | 111 | goto out; |
112 | } | 112 | } |
113 | } | 113 | } |
114 | |||
115 | if (free < 0) { | ||
116 | err = -ENOMEM; | ||
117 | goto out; | ||
118 | } | ||
119 | |||
114 | mlx4_dbg(dev, "Free MAC index is %d\n", free); | 120 | mlx4_dbg(dev, "Free MAC index is %d\n", free); |
115 | 121 | ||
116 | if (table->total == table->max) { | 122 | if (table->total == table->max) { |
@@ -205,6 +211,11 @@ int mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index) | |||
205 | } | 211 | } |
206 | } | 212 | } |
207 | 213 | ||
214 | if (free < 0) { | ||
215 | err = -ENOMEM; | ||
216 | goto out; | ||
217 | } | ||
218 | |||
208 | if (table->total == table->max) { | 219 | if (table->total == table->max) { |
209 | /* No free vlan entries */ | 220 | /* No free vlan entries */ |
210 | err = -ENOSPC; | 221 | err = -ENOSPC; |