This function checks the upper bound but it doesn't check for negative
numbers:
if (txq > QLCNIC_MAX_TX_RINGS) {
I've solved this by making "txq" a u32 type. I chose that because
->tx_count in the ethtool_channels struct is a __u32.
This bug was added in aa4a1f7df7 ('qlcnic: Enable Tx queue changes using
ethtool for 82xx Series adapter.').
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
80b17be70b