diff options
| author |   Jakub Kicinski <kuba@kernel.org> | 2022-11-07 20:00:13 -0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-11-07 20:00:14 -0800 |
| commit | 91c596cc8d321cd00b8782a2b16772a033a0adf8 (patch) | |
| tree | 04153647c8d6da1c931285c6233a91fb1d555083 | |
| parent | Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue (diff) | |
| parent | net: txgbe: Fix unsigned comparison to zero in txgbe_calc_eeprom_checksum() (diff) | |
| download | wireguard-linux-91c596cc8d321cd00b8782a2b16772a033a0adf8.tar.xz wireguard-linux-91c596cc8d321cd00b8782a2b16772a033a0adf8.zip | |
Merge branch 'net-txgbe-fix-two-bugs-in-txgbe_calc_eeprom_checksum'
YueHaibing says:
====================
net: txgbe: Fix two bugs in txgbe_calc_eeprom_checksum
Fix memleak and unsigned comparison bugs in txgbe_calc_eeprom_checksum
====================
Link: https://lore.kernel.org/r/20221105080722.20292-1-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c index 0b1032195859..167f7ff73192 100644 --- a/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c +++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c @@ -183,6 +183,7 @@ static int txgbe_calc_eeprom_checksum(struct txgbe_hw *hw, u16 *checksum) eeprom_ptrs); if (status != 0) { wx_err(wxhw, "Failed to read EEPROM image\n"); + kvfree(eeprom_ptrs); return status; } local_buffer = eeprom_ptrs; @@ -196,13 +197,14 @@ static int txgbe_calc_eeprom_checksum(struct txgbe_hw *hw, u16 *checksum) if (i != wxhw->eeprom.sw_region_offset + TXGBE_EEPROM_CHECKSUM) *checksum += local_buffer[i]; - *checksum = TXGBE_EEPROM_SUM - *checksum; - if (*checksum < 0) - return -EINVAL; - if (eeprom_ptrs) kvfree(eeprom_ptrs); + if (*checksum > TXGBE_EEPROM_SUM) + return -EINVAL; + + *checksum = TXGBE_EEPROM_SUM - *checksum; + return 0; } |