NET: r8169: fix past rtl_chip_info arraysize for unknown chipsets
Subsystems (2)
PATCH 1/1 NET: r8169: fix past rtl_chip_info arraysize for unknown chipsets
i is unsigned, so, with an unknown chip, for (;i >= 0;) fails and i just keeps decrementing, underflowing past ARRAY_SIZE(rtl_chip_info).
Signed-off-by Roel Kluin <[email protected]>
---
drivers/net/r8169.c +9 -11
@@ -1702,21 +1702,19 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)/* Identify chip attached to board */ rtl8169_get_mac_version (tp, ioaddr); -rtl8169_print_mac_version (tp); -for (i =ARRAY_SIZE (rtl_chip_info) -1 ; i >=0 ; i--) { -if (tp->mac_version == rtl_chip_info[i].mac_version) +for (i =ARRAY_SIZE (rtl_chip_info) -1 ; + tp->mac_version != rtl_chip_info[i].mac_version; i--) { +if (i ==0 ) { +/* Unknown chip: assume chipset 0: original RTL-8169 */ +if (netif_msg_probe (tp)) { +dev_printk (KERN_DEBUG , &pdev->dev, +"unknown chip version, assuming %s\n" , + rtl_chip_info[0 ].name); + }break ; - } -if (i <0 ) { -/* Unknown chip: assume array element #0, original RTL-8169 */ -if (netif_msg_probe (tp)) { -dev_printk (KERN_DEBUG , &pdev->dev, -"unknown chip version, assuming %s\n" , - rtl_chip_info[0 ].name); } - i++; } tp->chipset = i;