Commit 4710b2ba authored by David Gibson's avatar David Gibson Committed by David S. Miller

netxen: Correct off-by-one errors in bounds checks

netxen_process_lro() contains two bounds checks.  One for the ring number
against the number of rings, and one for the Rx buffer ID against the
array of receive buffers.

Both of these have off-by-one errors, using > instead of >=. The correct
versions are used in netxen_process_rcv(), they're just wrong in
netxen_process_lro().
Signed-off-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 73409f3b
...@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter, ...@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter,
u32 seq_number; u32 seq_number;
u8 vhdr_len = 0; u8 vhdr_len = 0;
if (unlikely(ring > adapter->max_rds_rings)) if (unlikely(ring >= adapter->max_rds_rings))
return NULL; return NULL;
rds_ring = &recv_ctx->rds_rings[ring]; rds_ring = &recv_ctx->rds_rings[ring];
index = netxen_get_lro_sts_refhandle(sts_data0); index = netxen_get_lro_sts_refhandle(sts_data0);
if (unlikely(index > rds_ring->num_desc)) if (unlikely(index >= rds_ring->num_desc))
return NULL; return NULL;
buffer = &rds_ring->rx_buf_arr[index]; buffer = &rds_ring->rx_buf_arr[index];
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment