Subject: [PATCH] gianfar: irq_of_parse_and_map() error unnoticed

From: Roel Kluin <[email-masked]>
Date: Thu, 23 Apr 2009 14:52:44 +0200

Not sure which irq_of_parse_and_map() is used, but I found definitions here:

vi arch/microblaze/kernel/irq.c +23
vi arch/powerpc/kernel/irq.c +727
vi arch/sparc/kernel/of_device_32.c +33
vi arch/sparc/kernel/of_device_64.c +59

They either return 0 or NO_IRQ - either defined 0, -1, 255 or INT_MAX.
------------------------------>8-------------8<---------------------------------
priv->interruptTransmit, -Receive and -Error are unsigned, so the error path
wasn't taken when irq_of_parse_and_map() returned an incorrect irq.

Signed-off-by: Roel Kluin <[email-masked]> 
---
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index b2c4967..e30d158 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -203,9 +203,12 @@ static int gfar_of_init(struct net_device *dev)
 
 		priv->interruptError = irq_of_parse_and_map(np, 2);
 
-		if (priv->interruptTransmit < 0 ||
-				priv->interruptReceive < 0 ||
-				priv->interruptError < 0) {
+		if (priv->interruptTransmit == 0 ||
+				priv->interruptTransmit > 254 ||
+				priv->interruptReceive == 0 ||
+				priv->interruptReceive > 254 ||
+				priv->interruptError == 0 ||
+				priv->interruptReceive > 254) {
 			err = -EINVAL;
 			goto err_out;
 		}