]> www.infradead.org Git - users/jedix/linux-maple.git/commit
qed: potential overflow in qed_cxt_src_t2_alloc()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 7 Jun 2016 12:04:16 +0000 (15:04 +0300)
committerChuck Anderson <chuck.anderson@oracle.com>
Wed, 10 Aug 2016 21:04:20 +0000 (14:04 -0700)
commitccf6fc5de052f8a2073ed83c05443491710c672c
treedb3043c3121395123f2da286bdd21e4655c79e4c
parentce67aa603ca11998c78bd0a76867f9a7611e505b
qed: potential overflow in qed_cxt_src_t2_alloc()

In the current code "ent_per_page" could be more than "conn_num" making
"conn_num" negative after the subtraction.  In the next iteration
through the loop then the negative is treated as a very high positive
meaning we don't put a limit on "ent_num".  It could lead to memory
corruption.

Fixes: dbb799c39717 ('qed: Initialize hardware for new protocols')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Yuval Mintz <Yuval.Mintz@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 24361996
Signed-off-by: Manjunath Govindashetty <manjunath.govindashetty@oracle.com>
drivers/net/ethernet/qlogic/qed/qed_cxt.c