aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
diff options
context:
space:
mode:
authorDavid Gibson <david@gibson.dropbear.id.au>2013-12-20 15:10:44 +1100
committerDavid S. Miller <davem@davemloft.net>2013-12-27 13:08:25 -0500
commit4710b2ba873692194c636811ceda398f95e02db2 (patch)
treef1d123b07ed76f251292b6f1a26f0bda98122068 /drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
parentnet: Add some clarification to skb_tx_timestamp() comment. (diff)
downloadlinux-dev-4710b2ba873692194c636811ceda398f95e02db2.tar.xz
linux-dev-4710b2ba873692194c636811ceda398f95e02db2.zip
netxen: Correct off-by-one errors in bounds checks
netxen_process_lro() contains two bounds checks. One for the ring number against the number of rings, and one for the Rx buffer ID against the array of receive buffers. Both of these have off-by-one errors, using > instead of >=. The correct versions are used in netxen_process_rcv(), they're just wrong in netxen_process_lro(). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c')
-rw-r--r--drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 7692dfd4f262..cc68657f0536 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter,
u32 seq_number;
u8 vhdr_len = 0;
- if (unlikely(ring > adapter->max_rds_rings))
+ if (unlikely(ring >= adapter->max_rds_rings))
return NULL;
rds_ring = &recv_ctx->rds_rings[ring];
index = netxen_get_lro_sts_refhandle(sts_data0);
- if (unlikely(index > rds_ring->num_desc))
+ if (unlikely(index >= rds_ring->num_desc))
return NULL;
buffer = &rds_ring->rx_buf_arr[index];