Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 46627170 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by David S. Miller
Browse files

nfp: use kvcalloc() to allocate SW buffer descriptor arrays 



Use kvcalloc() instead of tmp variable + kzalloc() when allocating
SW buffer information to allow falling back to vmalloc and to protect
from theoretical integer overflow.

Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: default avatarDirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b0ced17

drivers/net/ethernet/netronome/nfp/nfp_net_common.c

+8 −8
Original line number Diff line number Diff line
@@ -53,6 +53,7 @@ 
#include <linux/interrupt.h>

#include <linux/ip.h>

#include <linux/ipv6.h>

#include <linux/mm.h>

#include <linux/page_ref.h>

#include <linux/pci.h>

#include <linux/pci_regs.h>
@@ -2126,7 +2127,7 @@ static void nfp_net_tx_ring_free(struct nfp_net_tx_ring *tx_ring) 
	struct nfp_net_r_vector *r_vec = tx_ring->r_vec;

	struct nfp_net_dp *dp = &r_vec->nfp_net->dp;



	kfree(tx_ring->txbufs);

	kvfree(tx_ring->txbufs);



	if (tx_ring->txds)

		dma_free_coherent(dp->dev, tx_ring->size,
@@ -2150,7 +2151,6 @@ static int 
nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)

{

	struct nfp_net_r_vector *r_vec = tx_ring->r_vec;

	int sz;



	tx_ring->cnt = dp->txd_cnt;
@@ -2160,8 +2160,8 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring) 
	if (!tx_ring->txds)

		goto err_alloc;



	sz = sizeof(*tx_ring->txbufs) * tx_ring->cnt;

	tx_ring->txbufs = kzalloc(sz, GFP_KERNEL);

	tx_ring->txbufs = kvcalloc(tx_ring->cnt, sizeof(*tx_ring->txbufs),

				   GFP_KERNEL);

	if (!tx_ring->txbufs)

		goto err_alloc;
@@ -2275,7 +2275,7 @@ static void nfp_net_rx_ring_free(struct nfp_net_rx_ring *rx_ring) 


	if (dp->netdev)

		xdp_rxq_info_unreg(&rx_ring->xdp_rxq);

	kfree(rx_ring->rxbufs);

	kvfree(rx_ring->rxbufs);



	if (rx_ring->rxds)

		dma_free_coherent(dp->dev, rx_ring->size,
@@ -2298,7 +2298,7 @@ static void nfp_net_rx_ring_free(struct nfp_net_rx_ring *rx_ring) 
static int

nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)

{

	int sz, err;

	int err;



	if (dp->netdev) {

		err = xdp_rxq_info_reg(&rx_ring->xdp_rxq, dp->netdev,
@@ -2314,8 +2314,8 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring) 
	if (!rx_ring->rxds)

		goto err_alloc;



	sz = sizeof(*rx_ring->rxbufs) * rx_ring->cnt;

	rx_ring->rxbufs = kzalloc(sz, GFP_KERNEL);

	rx_ring->rxbufs = kvcalloc(rx_ring->cnt, sizeof(*rx_ring->rxbufs),

				   GFP_KERNEL);

	if (!rx_ring->rxbufs)

		goto err_alloc;