Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ea14712 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by David S. Miller
Browse files

nfp: protect from theoretical size overflows on HW descriptor ring 



Use array_size() and store the size as full size_t to protect from
theoretical size overflow when handling HW descriptor rings.

Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: default avatarDirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e76c1d3d

drivers/net/ethernet/netronome/nfp/nfp_net.h

+2 −2
Original line number Diff line number Diff line
@@ -250,7 +250,7 @@ struct nfp_net_tx_ring { 
	struct nfp_net_tx_desc *txds;



	dma_addr_t dma;

	unsigned int size;

	size_t size;

	bool is_xdp;

} ____cacheline_aligned;
@@ -372,7 +372,7 @@ struct nfp_net_rx_ring { 
	struct xdp_rxq_info xdp_rxq;



	dma_addr_t dma;

	unsigned int size;

	size_t size;

} ____cacheline_aligned;



/**

drivers/net/ethernet/netronome/nfp/nfp_net_common.c

+5 −4
Original line number Diff line number Diff line
@@ -54,6 +54,7 @@ 
#include <linux/ip.h>

#include <linux/ipv6.h>

#include <linux/mm.h>

#include <linux/overflow.h>

#include <linux/page_ref.h>

#include <linux/pci.h>

#include <linux/pci_regs.h>
@@ -1121,7 +1122,7 @@ nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring) 
		tx_ring->rd_p++;

	}



	memset(tx_ring->txds, 0, sizeof(*tx_ring->txds) * tx_ring->cnt);

	memset(tx_ring->txds, 0, tx_ring->size);

	tx_ring->wr_p = 0;

	tx_ring->rd_p = 0;

	tx_ring->qcp_rd_p = 0;
@@ -1301,7 +1302,7 @@ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring) 
	rx_ring->rxbufs[last_idx].dma_addr = 0;

	rx_ring->rxbufs[last_idx].frag = NULL;



	memset(rx_ring->rxds, 0, sizeof(*rx_ring->rxds) * rx_ring->cnt);

	memset(rx_ring->rxds, 0, rx_ring->size);

	rx_ring->wr_p = 0;

	rx_ring->rd_p = 0;

}
@@ -2154,7 +2155,7 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring) 


	tx_ring->cnt = dp->txd_cnt;



	tx_ring->size = sizeof(*tx_ring->txds) * tx_ring->cnt;

	tx_ring->size = array_size(tx_ring->cnt, sizeof(*tx_ring->txds));

	tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size,

					    &tx_ring->dma, GFP_KERNEL);

	if (!tx_ring->txds)
@@ -2308,7 +2309,7 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring) 
	}



	rx_ring->cnt = dp->rxd_cnt;

	rx_ring->size = sizeof(*rx_ring->rxds) * rx_ring->cnt;

	rx_ring->size = array_size(rx_ring->cnt, sizeof(*rx_ring->rxds));

	rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size,

					    &rx_ring->dma, GFP_KERNEL);

	if (!rx_ring->rxds)