bnx2x: off by one in bnx2x_ets_e3b0_sp_pri_to_cos_set()

The sp_pri_to_cos[] array size depends on the config but lets say it is
BX_E3B0_MAX_NUM_COS_PORT0 and max_num_of_cos is also
DCBX_E3B0_MAX_NUM_COS_PORT0.  In the original code
"pri == max_num_of_cos" was accepted but it is one past the end of the
array.

Also we used "pri" before capping it.  It's a harmless read past the end
of the array, but it would affect which error message gets printed.

(cherry picked from commit 7e5998aa74065d3ab31d17e667f40ffebf4b8425)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Joe Jin <joe.jin@oracle.com>

diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index e4c4d8ad90c8fdac5170f6e0ff58b43da10abdf8..cb3e05a86b464dd2f255186b75f6bc926d552e30 100644 (file)
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -922,6 +922,12 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params,
        const u8 max_num_of_cos = (port) ? DCBX_E3B0_MAX_NUM_COS_PORT1 :
                DCBX_E3B0_MAX_NUM_COS_PORT0;
 
+       if (pri >= max_num_of_cos) {
+               DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "
+                  "parameter Illegal strict priority\n");
+           return -EINVAL;
+       }
+
        if (sp_pri_to_cos[pri] != DCBX_INVALID_COS) {
                DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "
                                   "parameter There can't be two COS's with "
@@ -929,12 +935,6 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params,
                return -EINVAL;
        }
 
-       if (pri > max_num_of_cos) {
-               DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "
-                  "parameter Illegal strict priority\n");
-           return -EINVAL;
-       }
-
        sp_pri_to_cos[pri] = cos_entry;
        return 0;