cxgb4: fix signed wrap around when decrementing index idx

Change predecrement compare to post decrement compare to avoid an
unsigned integer wrap-around comparison when decrementing idx in
the while loop.

For example, when idx is zero, the current situation will
predecrement idx in the while loop, wrapping idx to the maximum
signed integer and cause out of bounds reads on rxq_info->msix_tbl[idx].

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index d12a73e03565ca82989580020bb00f12034e4190..f13b593d7c8b434204f1cb996d14084f4c04cdaa 100644 (file)
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -367,7 +367,7 @@ int request_msix_queue_irqs_uld(struct adapter *adap, unsigned int uld_type)
        }
        return 0;
 unwind:
-       while (--idx >= 0) {
+       while (idx-- > 0) {
                bmap_idx = rxq_info->msix_tbl[idx];
                free_msix_idx_in_bmap(adap, bmap_idx);
                free_irq(adap->msix_info_ulds[bmap_idx].vec,