Revert "bnx2: Search VPD with pci_vpd_find_ro_info_keyword()"

This reverts commit ddc122a.

Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/ethernet/broadcom/bnx2.c

@@ -8033,9 +8033,9 @@ bnx2_get_pci_speed(struct bnx2 *bp)
 static void
 bnx2_read_vpd_fw_ver(struct bnx2 *bp)
 {
-	unsigned int len;
 	int rc, i, j;
 	u8 *data;
+	unsigned int block_end, rosize, len;
 
 #define BNX2_VPD_NVRAM_OFFSET	0x300
 #define BNX2_VPD_LEN		128
@@ -8052,21 +8052,38 @@ bnx2_read_vpd_fw_ver(struct bnx2 *bp)
 	for (i = 0; i < BNX2_VPD_LEN; i += 4)
 		swab32s((u32 *)&data[i]);
 
-	j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN,
-					 PCI_VPD_RO_KEYWORD_MFR_ID, &len);
+	i = pci_vpd_find_tag(data, BNX2_VPD_LEN, PCI_VPD_LRDT_RO_DATA);
+	if (i < 0)
+		goto vpd_done;
+
+	rosize = pci_vpd_lrdt_size(&data[i]);
+	i += PCI_VPD_LRDT_TAG_SIZE;
+	block_end = i + rosize;
+
+	if (block_end > BNX2_VPD_LEN)
+		goto vpd_done;
+
+	j = pci_vpd_find_info_keyword(data, i, rosize,
+				      PCI_VPD_RO_KEYWORD_MFR_ID);
 	if (j < 0)
 		goto vpd_done;
 
-	if (len != 4 || memcmp(&data[j], "1028", 4))
+	len = pci_vpd_info_field_size(&data[j]);
+
+	j += PCI_VPD_INFO_FLD_HDR_SIZE;
+	if (j + len > block_end || len != 4 ||
+	    memcmp(&data[j], "1028", 4))
 		goto vpd_done;
 
-	j = pci_vpd_find_ro_info_keyword(data, BNX2_VPD_LEN,
-					 PCI_VPD_RO_KEYWORD_VENDOR0,
-					 &len);
+	j = pci_vpd_find_info_keyword(data, i, rosize,
+				      PCI_VPD_RO_KEYWORD_VENDOR0);
 	if (j < 0)
 		goto vpd_done;
 
-	if (len > BNX2_MAX_VER_SLEN)
+	len = pci_vpd_info_field_size(&data[j]);
+
+	j += PCI_VPD_INFO_FLD_HDR_SIZE;
+	if (j + len > block_end || len > BNX2_MAX_VER_SLEN)
 		goto vpd_done;
 
 	memcpy(bp->fw_version, &data[j], len);