qlcnic: underflow in qlcnic_validate_max_tx_rings()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 27 Aug 2013 01:16:22 +0000 (04:16 +0300)
committerDavid S. Miller <davem@davemloft.net>
Thu, 29 Aug 2013 05:24:08 +0000 (01:24 -0400)
commit80b17be70b63646cb141bf1826afe32281e561ec
treec82c0382e811d69142caf8bcd0133a443df189f6
parent823a19e0cfee2ea4cacd4976730f34151481e7ac
qlcnic: underflow in qlcnic_validate_max_tx_rings()

This function checks the upper bound but it doesn't check for negative
numbers:

if (txq > QLCNIC_MAX_TX_RINGS) {

I've solved this by making "txq" a u32 type.  I chose that because
->tx_count in the ethtool_channels struct is a __u32.

This bug was added in aa4a1f7df7 ('qlcnic: Enable Tx queue changes using
ethtool for 82xx Series adapter.').

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c