aboutsummaryrefslogtreecommitdiff
path: root/drivers/net
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/bnx2.c49
1 files changed, 21 insertions, 28 deletions
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index cf4322d0182..4bfc8081292 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -7730,24 +7730,27 @@ bnx2_read_vpd_fw_ver(struct bnx2 *bp)
u8 *v0_str = NULL;
bool mn_match = false;
+#define BNX2_VPD_NVRAM_OFFSET 0x300
+#define BNX2_VPD_LEN 128
#define BNX2_MAX_VER_SLEN 30
data = kmalloc(256, GFP_KERNEL);
if (!data)
return;
- rc = bnx2_nvram_read(bp, 0x300, data + 128, 128);
+ rc = bnx2_nvram_read(bp, BNX2_VPD_NVRAM_OFFSET, data + BNX2_VPD_LEN,
+ BNX2_VPD_LEN);
if (rc)
goto vpd_done;
- for (i = 0; i < 128; i += 4) {
- data[i] = data[i + 131];
- data[i + 1] = data[i + 130];
- data[i + 2] = data[i + 129];
- data[i + 3] = data[i + 128];
+ for (i = 0; i < BNX2_VPD_LEN; i += 4) {
+ data[i] = data[i + BNX2_VPD_LEN + 3];
+ data[i + 1] = data[i + BNX2_VPD_LEN + 2];
+ data[i + 2] = data[i + BNX2_VPD_LEN + 1];
+ data[i + 3] = data[i + BNX2_VPD_LEN];
}
- for (i = 0; i < 128; ) {
+ for (i = 0; i <= BNX2_VPD_LEN - 3; ) {
unsigned char val = data[i];
unsigned int block_end;
@@ -7762,39 +7765,29 @@ bnx2_read_vpd_fw_ver(struct bnx2 *bp)
block_end = (i + 3 + (data[i + 1] + (data[i + 2] << 8)));
i += 3;
- if (block_end > 128)
+ if (block_end > BNX2_VPD_LEN)
goto vpd_done;
while (i < (block_end - 2)) {
- if (data[i] == 'M' && data[i + 1] == 'N') {
- int mn_len = data[i + 2];
+ int len = data[i + 2];
- if (mn_len != 4)
- goto vpd_done;
+ if (i + 3 + len > block_end)
+ goto vpd_done;
- i += 3;
- if (memcmp(&data[i], "1028", 4))
+ if (data[i] == 'M' && data[i + 1] == 'N') {
+ if (len != 4 ||
+ memcmp(&data[i + 3], "1028", 4))
goto vpd_done;
mn_match = true;
- i += 4;
} else if (data[i] == 'V' && data[i + 1] == '0') {
- v0_len = data[i + 2];
-
- i += 3;
- if (v0_len > BNX2_MAX_VER_SLEN ||
- (v0_len + i) > 128)
+ if (len > BNX2_MAX_VER_SLEN)
goto vpd_done;
- if (v0_len > BNX2_MAX_VER_SLEN)
- v0_len = BNX2_MAX_VER_SLEN;
-
- v0_str = &data[i];
- i += data[i + 2];
-
- } else {
- i += 3 + data[i + 2];
+ v0_len = len;
+ v0_str = &data[i + 3];
}
+ i += 3 + len;
if (mn_match && v0_str) {
memcpy(bp->fw_version, v0_str, v0_len);