find_first_zero_bit()'s parameter 'size' is defined in bits,
not in bytes.

Calling find_first_zero_bit() with the wrong size unit
will lead to insidious bugs.

Fix this by calling find_first_zero_bit() with size
BITS_PER_LONG, rather than sizeof().

Also add proper error handling for find_first_zero_bit(),
since this was missing.

Fixes: d74679911610 ("PCI: endpoint: Introduce configfs entry for configuring 
EP functions")
Signed-off-by: Niklas Cassel <niklas.cas...@axis.com>
---
 drivers/pci/endpoint/pci-ep-cfs.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/endpoint/pci-ep-cfs.c 
b/drivers/pci/endpoint/pci-ep-cfs.c
index e1f5adc9e113..0a22a7976580 100644
--- a/drivers/pci/endpoint/pci-ep-cfs.c
+++ b/drivers/pci/endpoint/pci-ep-cfs.c
@@ -109,7 +109,12 @@ static int pci_epc_epf_link(struct config_item *epc_item,
                return ret;
 
        func_no = find_first_zero_bit(&epc_group->function_num_map,
-                                     sizeof(epc_group->function_num_map));
+                                     BITS_PER_LONG);
+       if (func_no >= BITS_PER_LONG) {
+               ret = -EINVAL;
+               dev_err(&epc->dev, "failed to link endpoint function device\n");
+               goto err_func_no;
+       }
        set_bit(func_no, &epc_group->function_num_map);
        epf->func_no = func_no;
 
@@ -121,6 +126,7 @@ static int pci_epc_epf_link(struct config_item *epc_item,
 
 err_epf_bind:
        clear_bit(func_no, &epc_group->function_num_map);
+err_func_no:
        pci_epc_remove_epf(epc, epf);
 
        return ret;
-- 
2.14.2

Reply via email to