find_first_zero_bit()'s parameter 'size' is defined in bits,
not in bytes.
Calling find_first_zero_bit() with the wrong size unit
will lead to insidious bugs.
Fix this by calling find_first_zero_bit() with size BITS_PER_LONG,
rather than sizeof() and add missing find_first_zero_bit() return
handling.
Fixes: d74679911610 ("PCI: endpoint: Introduce configfs entry for configuring EP functions")
Signed-off-by: Niklas Cassel <niklas.cassel@xxxxxxxx>
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@xxxxxxx>
---
drivers/pci/endpoint/pci-ep-cfs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/endpoint/pci-ep-cfs.c b/drivers/pci/endpoint/pci-ep-cfs.c
index e1f5adc9e113..f5ccd1aa2963 100644
--- a/drivers/pci/endpoint/pci-ep-cfs.c
+++ b/drivers/pci/endpoint/pci-ep-cfs.c
@@ -109,7 +109,11 @@ static int pci_epc_epf_link(struct config_item *epc_item,
return ret;
func_no = find_first_zero_bit(&epc_group->function_num_map,
- sizeof(epc_group->function_num_map));
+ BITS_PER_LONG);
+ if (func_no >= BITS_PER_LONG) {
+ ret = -EINVAL;
+ goto err_func_no;
+ }
set_bit(func_no, &epc_group->function_num_map);
epf->func_no = func_no;
@@ -121,6 +125,7 @@ static int pci_epc_epf_link(struct config_item *epc_item,
err_epf_bind:
clear_bit(func_no, &epc_group->function_num_map);
+err_func_no:
pci_epc_remove_epf(epc, epf);
return ret;
--
2.14.2
