'card_idx' can be overflowed when fealnx_init_one() will be called more than INT_MAX times. Check before incremention is required.
Fixes: 15c037d6423e ("fealnx: Move the Myson driver") Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Ilya Krutskih devsec@tpz.ru --- drivers/net/ethernet/fealnx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c index 6ac8547ef9b8..7eb6e42b4551 100644 --- a/drivers/net/ethernet/fealnx.c +++ b/drivers/net/ethernet/fealnx.c @@ -489,7 +489,10 @@ static int fealnx_init_one(struct pci_dev *pdev, int bar = 1; #endif
- card_idx++; + if (card_idx == INT_MAX) + return -EINVAL; + else + card_idx++; sprintf(boardname, "fealnx%d", card_idx);
option = card_idx < MAX_UNITS ? options[card_idx] : 0;