diff mbox

[dpdk-dev] ixgbe: Out-by-one in get/set EEPROM

Message ID 1442408865-7569-1-git-send-email-remy.horton@intel.com (mailing list archive)
State Superseded, archived
Headers

Commit Message

Remy Horton Sept. 16, 2015, 1:07 p.m. UTC 
  Incorrect operator in ixgbe_get_eeprom & ixgbe_set_eeprom prevents
last byte of EEPROM being read/written, and hence cannot be dumped
or updated in entirity using these functions.

Signed-off-by: Remy Horton <remy.horton@intel.com>
---
 drivers/net/ixgbe/ixgbe_ethdev.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

Comments

Thomas Monjalon Sept. 16, 2015, 1:23 p.m. UTC | #1 
2015-09-16 14:07, Remy Horton:
> Incorrect operator in ixgbe_get_eeprom & ixgbe_set_eeprom prevents
> last byte of EEPROM being read/written, and hence cannot be dumped
> or updated in entirity using these functions.

This explanation is good but the title is not clear enough. It should
start with "ixgbe: fix". Fix what? I'd say "fix access to last byte of EEPROM".
Then creating a commit starting with "fix" should trigger 2 other things:
	- a Fixes: tag
	- an update in the release notes (because the bug exists in previous releases)

Thanks
diff mbox

Patch

diff --git a/drivers/net/ixgbe/ixgbe_ethdev.c b/drivers/net/ixgbe/ixgbe_ethdev.c
index ec2918c..4a7ee3b 100644
--- a/drivers/net/ixgbe/ixgbe_ethdev.c
+++ b/drivers/net/ixgbe/ixgbe_ethdev.c
@@ -5444,8 +5444,8 @@  ixgbe_get_eeprom(struct rte_eth_dev *dev,
 
 	first = in_eeprom->offset >> 1;
 	length = in_eeprom->length >> 1;
-	if ((first >= hw->eeprom.word_size) ||
-	    ((first + length) >= hw->eeprom.word_size))
+	if ((first > hw->eeprom.word_size) ||
+	    ((first + length) > hw->eeprom.word_size))
 		return -EINVAL;
 
 	in_eeprom->magic = hw->vendor_id | (hw->device_id << 16);
@@ -5464,8 +5464,8 @@  ixgbe_set_eeprom(struct rte_eth_dev *dev,
 
 	first = in_eeprom->offset >> 1;
 	length = in_eeprom->length >> 1;
-	if ((first >= hw->eeprom.word_size) ||
-	    ((first + length) >= hw->eeprom.word_size))
+	if ((first > hw->eeprom.word_size) ||
+	    ((first + length) > hw->eeprom.word_size))
 		return -EINVAL;
 
 	in_eeprom->magic = hw->vendor_id | (hw->device_id << 16);