From: Ben Hutchings <bhutchings@solarflare.com>
Date: Tue, 6 Sep 2011 12:44:25 +0000 (+0000)
Subject: gianfar: Fix overflow check and return value for gfar_get_cls_all()
X-Git-Tag: v3.1-rc7~2^2~6
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=710778ff878a06654175863db133293007d45aee;p=platform%2Fupstream%2Fkernel-adaptation-pc.git

gianfar: Fix overflow check and return value for gfar_get_cls_all()

This function may currently fill one entry beyond the end of the
array it is given.  It also doesn't return an error code in case
it does detect overflow.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 25a8c2a..0caf3c3 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -1669,10 +1669,10 @@ static int gfar_get_cls_all(struct gfar_private *priv,
 	u32 i = 0;
 
 	list_for_each_entry(comp, &priv->rx_list.list, list) {
-		if (i <= cmd->rule_cnt) {
-			rule_locs[i] = comp->fs.location;
-			i++;
-		}
+		if (i == cmd->rule_cnt)
+			return -EMSGSIZE;
+		rule_locs[i] = comp->fs.location;
+		i++;
 	}
 
 	cmd->data = MAX_FILER_IDX;