Avoid possible overflows when validating eeprom->offset and eeprom->len
against bp->flash_info->total_size in bnx2_get_eeprom.
Signed-off-by: John W. Linville <[EMAIL PROTECTED]>
---
drivers/net/bnx2.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
applies-to: 03593ee43957bc3b3b9596e445a33496eb64c8d5
f917e0352f5b2a341c302fc86c94ccfca2a18abc
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 32267d5..5459e2e 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -4803,7 +4803,7 @@ bnx2_get_eeprom(struct net_device *dev,
if (eeprom->offset > bp->flash_info->total_size)
return -EINVAL;
- if ((eeprom->offset + eeprom->len) > bp->flash_info->total_size)
+ if (eeprom->offset > bp->flash_info->total_size - eeprom->len)
eeprom->len = bp->flash_info->total_size - eeprom->offset;
rc = bnx2_nvram_read(bp, eeprom->offset, eebuf, eeprom->len);
@@ -4821,7 +4821,7 @@ bnx2_set_eeprom(struct net_device *dev,
if (eeprom->offset > bp->flash_info->total_size)
return -EINVAL;
- if ((eeprom->offset + eeprom->len) > bp->flash_info->total_size)
+ if (eeprom->offset > bp->flash_info->total_size - eeprom->len)
eeprom->len = bp->flash_info->total_size - eeprom->offset;
rc = bnx2_nvram_write(bp, eeprom->offset, eebuf, eeprom->len);
---
0.99.9.GIT
--
John W. Linville
[EMAIL PROTECTED]
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
