Loading drivers/net/ethernet/broadcom/bnx2.c +25 −8 Original line number Diff line number Diff line Loading @@ -8033,9 +8033,9 @@ bnx2_get_pci_speed(struct bnx2 *bp) static void bnx2_read_vpd_fw_ver(struct bnx2 *bp) { unsigned int len; int rc, i, j; u8 *data; unsigned int block_end, rosize, len; #define BNX2_VPD_NVRAM_OFFSET 0x300 #define BNX2_VPD_LEN 128 Loading @@ -8052,21 +8052,38 @@ bnx2_read_vpd_fw_ver(struct bnx2 *bp) for (i = 0; i < BNX2_VPD_LEN; i += 4) swab32s((u32 *)&data[i]); j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN, PCI_VPD_RO_KEYWORD_MFR_ID, &len); i = pci_vpd_find_tag(data, BNX2_VPD_LEN, PCI_VPD_LRDT_RO_DATA); if (i < 0) goto vpd_done; rosize = pci_vpd_lrdt_size(&data[i]); i += PCI_VPD_LRDT_TAG_SIZE; block_end = i + rosize; if (block_end > BNX2_VPD_LEN) goto vpd_done; j = pci_vpd_find_info_keyword(data, i, rosize, PCI_VPD_RO_KEYWORD_MFR_ID); if (j < 0) goto vpd_done; if (len != 4 || memcmp(&data[j], "1028", 4)) len = pci_vpd_info_field_size(&data[j]); j += PCI_VPD_INFO_FLD_HDR_SIZE; if (j + len > block_end || len != 4 || memcmp(&data[j], "1028", 4)) goto vpd_done; j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN, PCI_VPD_RO_KEYWORD_VENDOR0, &len); j = pci_vpd_find_info_keyword(data, i, rosize, PCI_VPD_RO_KEYWORD_VENDOR0); if (j < 0) goto vpd_done; if (len > BNX2_MAX_VER_SLEN) len = pci_vpd_info_field_size(&data[j]); j += PCI_VPD_INFO_FLD_HDR_SIZE; if (j + len > block_end || len > BNX2_MAX_VER_SLEN) goto vpd_done; memcpy(bp->fw_version, &data[j], len); Loading Loading
drivers/net/ethernet/broadcom/bnx2.c +25 −8 Original line number Diff line number Diff line Loading @@ -8033,9 +8033,9 @@ bnx2_get_pci_speed(struct bnx2 *bp) static void bnx2_read_vpd_fw_ver(struct bnx2 *bp) { unsigned int len; int rc, i, j; u8 *data; unsigned int block_end, rosize, len; #define BNX2_VPD_NVRAM_OFFSET 0x300 #define BNX2_VPD_LEN 128 Loading @@ -8052,21 +8052,38 @@ bnx2_read_vpd_fw_ver(struct bnx2 *bp) for (i = 0; i < BNX2_VPD_LEN; i += 4) swab32s((u32 *)&data[i]); j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN, PCI_VPD_RO_KEYWORD_MFR_ID, &len); i = pci_vpd_find_tag(data, BNX2_VPD_LEN, PCI_VPD_LRDT_RO_DATA); if (i < 0) goto vpd_done; rosize = pci_vpd_lrdt_size(&data[i]); i += PCI_VPD_LRDT_TAG_SIZE; block_end = i + rosize; if (block_end > BNX2_VPD_LEN) goto vpd_done; j = pci_vpd_find_info_keyword(data, i, rosize, PCI_VPD_RO_KEYWORD_MFR_ID); if (j < 0) goto vpd_done; if (len != 4 || memcmp(&data[j], "1028", 4)) len = pci_vpd_info_field_size(&data[j]); j += PCI_VPD_INFO_FLD_HDR_SIZE; if (j + len > block_end || len != 4 || memcmp(&data[j], "1028", 4)) goto vpd_done; j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN, PCI_VPD_RO_KEYWORD_VENDOR0, &len); j = pci_vpd_find_info_keyword(data, i, rosize, PCI_VPD_RO_KEYWORD_VENDOR0); if (j < 0) goto vpd_done; if (len > BNX2_MAX_VER_SLEN) len = pci_vpd_info_field_size(&data[j]); j += PCI_VPD_INFO_FLD_HDR_SIZE; if (j + len > block_end || len > BNX2_MAX_VER_SLEN) goto vpd_done; memcpy(bp->fw_version, &data[j], len); Loading