Commit 3fb2a54b authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/t 


nguy/net-queue

Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2021-09-27

This series contains updates to e100 driver only.

Jake corrects under allocation of register buffer due to incorrect
calculations and fixes buffer overrun of register dump.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 05e97b3d 51032e6f

drivers/net/ethernet/intel/e100.c

+15 −7
Original line number Diff line number Diff line
@@ -2437,11 +2437,15 @@ static void e100_get_drvinfo(struct net_device *netdev, 
		sizeof(info->bus_info));

}



#define E100_PHY_REGS 0x1C

#define E100_PHY_REGS 0x1D

static int e100_get_regs_len(struct net_device *netdev)

{

	struct nic *nic = netdev_priv(netdev);

	return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf);



	/* We know the number of registers, and the size of the dump buffer.

	 * Calculate the total size in bytes.

	 */

	return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf);

}



static void e100_get_regs(struct net_device *netdev,
@@ -2455,13 +2459,17 @@ static void e100_get_regs(struct net_device *netdev, 
	buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 |

		ioread8(&nic->csr->scb.cmd_lo) << 16 |

		ioread16(&nic->csr->scb.status);

	for (i = E100_PHY_REGS; i >= 0; i--)

		buff[1 + E100_PHY_REGS - i] =

			mdio_read(netdev, nic->mii.phy_id, i);

	for (i = 0; i < E100_PHY_REGS; i++)

		/* Note that we read the registers in reverse order. This

		 * ordering is the ABI apparently used by ethtool and other

		 * applications.

		 */

		buff[1 + i] = mdio_read(netdev, nic->mii.phy_id,

					E100_PHY_REGS - 1 - i);

	memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf));

	e100_exec_cb(nic, NULL, e100_dump);

	msleep(10);

	memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf,

	memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf,

	       sizeof(nic->mem->dump_buf));

}