From 3408259b6ae5b01cd216633509f360def1d58dd5 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Mon, 23 Aug 2021 11:05:19 +0100 Subject: [PATCH] Revert "bnx2: Search VPD with pci_vpd_find_ro_info_keyword()" This reverts commit ddc122aac91f6f589ed7e202dbfca9f106d2a06f. Signed-off-by: David S. Miller --- drivers/net/ethernet/broadcom/bnx2.c | 33 +++++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c index 37c02729..3446483 100644 --- a/drivers/net/ethernet/broadcom/bnx2.c +++ b/drivers/net/ethernet/broadcom/bnx2.c @@ -8033,9 +8033,9 @@ bnx2_get_pci_speed(struct bnx2 *bp) static void bnx2_read_vpd_fw_ver(struct bnx2 *bp) { - unsigned int len; int rc, i, j; u8 *data; + unsigned int block_end, rosize, len; #define BNX2_VPD_NVRAM_OFFSET 0x300 #define BNX2_VPD_LEN 128 @@ -8052,21 +8052,38 @@ bnx2_read_vpd_fw_ver(struct bnx2 *bp) for (i = 0; i < BNX2_VPD_LEN; i += 4) swab32s((u32 *)&data[i]); - j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN, - PCI_VPD_RO_KEYWORD_MFR_ID, &len); + i = pci_vpd_find_tag(data, BNX2_VPD_LEN, PCI_VPD_LRDT_RO_DATA); + if (i < 0) + goto vpd_done; + + rosize = pci_vpd_lrdt_size(&data[i]); + i += PCI_VPD_LRDT_TAG_SIZE; + block_end = i + rosize; + + if (block_end > BNX2_VPD_LEN) + goto vpd_done; + + j = pci_vpd_find_info_keyword(data, i, rosize, + PCI_VPD_RO_KEYWORD_MFR_ID); if (j < 0) goto vpd_done; - if (len != 4 || memcmp(&data[j], "1028", 4)) + len = pci_vpd_info_field_size(&data[j]); + + j += PCI_VPD_INFO_FLD_HDR_SIZE; + if (j + len > block_end || len != 4 || + memcmp(&data[j], "1028", 4)) goto vpd_done; - j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN, - PCI_VPD_RO_KEYWORD_VENDOR0, - &len); + j = pci_vpd_find_info_keyword(data, i, rosize, + PCI_VPD_RO_KEYWORD_VENDOR0); if (j < 0) goto vpd_done; - if (len > BNX2_MAX_VER_SLEN) + len = pci_vpd_info_field_size(&data[j]); + + j += PCI_VPD_INFO_FLD_HDR_SIZE; + if (j + len > block_end || len > BNX2_MAX_VER_SLEN) goto vpd_done; memcpy(bp->fw_version, &data[j], len); -- 2.7.4