summaryrefslogtreecommitdiff
path: root/drivers/net/mlx4
diff options
context:
space:
mode:
authorEli Cohen <eli@dev.mellanox.co.il>2010-10-25 02:56:47 +0000
committerDavid S. Miller <davem@davemloft.net>2010-10-25 12:14:11 -0700
commit0926f91083f34d047abc74f1ca4fa6a9c161f7db (patch)
tree751135348a369dcdf85100b2cc7c7f8aefb508da /drivers/net/mlx4
parentb336369c1e1ad88495895260a9068eb18bc48b6c (diff)
mlx4_en: Fix out of bounds array access
When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access. Fix this by adding a proper check outside the loop. Signed-off-by: Eli Cohen <eli@mellanox.co.il> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/mlx4')
-rw-r--r--drivers/net/mlx4/port.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/drivers/net/mlx4/port.c b/drivers/net/mlx4/port.c
index 606aa58afdea..8674ad5764c4 100644
--- a/drivers/net/mlx4/port.c
+++ b/drivers/net/mlx4/port.c
@@ -111,6 +111,12 @@ int mlx4_register_mac(struct mlx4_dev *dev, u8 port, u64 mac, int *index)
goto out;
}
}
+
+ if (free < 0) {
+ err = -ENOMEM;
+ goto out;
+ }
+
mlx4_dbg(dev, "Free MAC index is %d\n", free);
if (table->total == table->max) {
@@ -205,6 +211,11 @@ int mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index)
}
}
+ if (free < 0) {
+ err = -ENOMEM;
+ goto out;
+ }
+
if (table->total == table->max) {
/* No free vlan entries */
err = -ENOSPC;