find_first_zero_bit()'s parameter 'size' is defined in bits,
not in bytes.
Calling find_first_zero_bit() with the wrong size unit
will lead to insidious bugs.
Fix this by calling find_first_zero_bit() with size
BITS_PER_LONG, rather than sizeof().
Also add proper error handling for find_first_zero_bit(),
since this was missing.
Fixes: d74679911610 ("PCI: endpoint: Introduce configfs entry for configuring EP functions")
Signed-off-by: Niklas Cassel <niklas.cassel@xxxxxxxx>
---
drivers/pci/endpoint/pci-ep-cfs.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/endpoint/pci-ep-cfs.c b/drivers/pci/endpoint/pci-ep-cfs.c
index e1f5adc9e113..0a22a7976580 100644
--- a/drivers/pci/endpoint/pci-ep-cfs.c
+++ b/drivers/pci/endpoint/pci-ep-cfs.c
@@ -109,7 +109,12 @@ static int pci_epc_epf_link(struct config_item *epc_item,
return ret;
func_no = find_first_zero_bit(&epc_group->function_num_map,
- sizeof(epc_group->function_num_map));
+ BITS_PER_LONG);
+ if (func_no >= BITS_PER_LONG) {
+ ret = -EINVAL;
+ dev_err(&epc->dev, "failed to link endpoint function device\n");
+ goto err_func_no;
+ }
set_bit(func_no, &epc_group->function_num_map);
epf->func_no = func_no;
@@ -121,6 +126,7 @@ static int pci_epc_epf_link(struct config_item *epc_item,
err_epf_bind:
clear_bit(func_no, &epc_group->function_num_map);
+err_func_no:
pci_epc_remove_epf(epc, epf);
return ret;
--
2.14.2
