diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 5df00a520fd232c9f8cbfd5608c11b554f55dde0..00a9b71267a86ececba4e3cb4cbd4fff69e00a16 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -13174,8 +13174,8 @@ static int bnxt_init_mac_addr(struct bnxt *bp) static void bnxt_vpd_read_info(struct bnxt *bp) { struct pci_dev *pdev = bp->pdev; - unsigned int vpd_size, kw_len; - int pos, size; + int i, len, pos, ro_size, size; + unsigned int vpd_size; u8 *vpd_data; vpd_data = pci_vpd_alloc(pdev, &vpd_size); @@ -13184,22 +13184,42 @@ static void bnxt_vpd_read_info(struct bnxt *bp) return; } - pos = pci_vpd_find_ro_info_keyword(vpd_data, vpd_size, - PCI_VPD_RO_KEYWORD_PARTNO, &kw_len); + i = pci_vpd_find_tag(vpd_data, vpd_size, PCI_VPD_LRDT_RO_DATA); + if (i < 0) { + netdev_err(bp->dev, "VPD READ-Only not found\n"); + goto exit; + } + + ro_size = pci_vpd_lrdt_size(&vpd_data[i]); + i += PCI_VPD_LRDT_TAG_SIZE; + if (i + ro_size > vpd_size) + goto exit; + + pos = pci_vpd_find_info_keyword(vpd_data, i, ro_size, + PCI_VPD_RO_KEYWORD_PARTNO); if (pos < 0) goto read_sn; - size = min_t(int, kw_len, BNXT_VPD_FLD_LEN - 1); + len = pci_vpd_info_field_size(&vpd_data[pos]); + pos += PCI_VPD_INFO_FLD_HDR_SIZE; + if (len + pos > vpd_size) + goto read_sn; + + size = min(len, BNXT_VPD_FLD_LEN - 1); memcpy(bp->board_partno, &vpd_data[pos], size); read_sn: - pos = pci_vpd_find_ro_info_keyword(vpd_data, vpd_size, - PCI_VPD_RO_KEYWORD_SERIALNO, - &kw_len); + pos = pci_vpd_find_info_keyword(vpd_data, i, ro_size, + PCI_VPD_RO_KEYWORD_SERIALNO); if (pos < 0) goto exit; - size = min_t(int, kw_len, BNXT_VPD_FLD_LEN - 1); + len = pci_vpd_info_field_size(&vpd_data[pos]); + pos += PCI_VPD_INFO_FLD_HDR_SIZE; + if (len + pos > vpd_size) + goto exit; + + size = min(len, BNXT_VPD_FLD_LEN - 1); memcpy(bp->board_serialno, &vpd_data[pos], size); exit: kfree(vpd_data);