Commit 5ea14712 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by David S. Miller

nfp: protect from theoretical size overflows on HW descriptor ring

Use array_size() and store the size as full size_t to protect from
theoretical size overflow when handling HW descriptor rings.
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: default avatarDirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e76c1d3d
...@@ -250,7 +250,7 @@ struct nfp_net_tx_ring { ...@@ -250,7 +250,7 @@ struct nfp_net_tx_ring {
struct nfp_net_tx_desc *txds; struct nfp_net_tx_desc *txds;
dma_addr_t dma; dma_addr_t dma;
unsigned int size; size_t size;
bool is_xdp; bool is_xdp;
} ____cacheline_aligned; } ____cacheline_aligned;
...@@ -372,7 +372,7 @@ struct nfp_net_rx_ring { ...@@ -372,7 +372,7 @@ struct nfp_net_rx_ring {
struct xdp_rxq_info xdp_rxq; struct xdp_rxq_info xdp_rxq;
dma_addr_t dma; dma_addr_t dma;
unsigned int size; size_t size;
} ____cacheline_aligned; } ____cacheline_aligned;
/** /**
......
...@@ -54,6 +54,7 @@ ...@@ -54,6 +54,7 @@
#include <linux/ip.h> #include <linux/ip.h>
#include <linux/ipv6.h> #include <linux/ipv6.h>
#include <linux/mm.h> #include <linux/mm.h>
#include <linux/overflow.h>
#include <linux/page_ref.h> #include <linux/page_ref.h>
#include <linux/pci.h> #include <linux/pci.h>
#include <linux/pci_regs.h> #include <linux/pci_regs.h>
...@@ -1121,7 +1122,7 @@ nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring) ...@@ -1121,7 +1122,7 @@ nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
tx_ring->rd_p++; tx_ring->rd_p++;
} }
memset(tx_ring->txds, 0, sizeof(*tx_ring->txds) * tx_ring->cnt); memset(tx_ring->txds, 0, tx_ring->size);
tx_ring->wr_p = 0; tx_ring->wr_p = 0;
tx_ring->rd_p = 0; tx_ring->rd_p = 0;
tx_ring->qcp_rd_p = 0; tx_ring->qcp_rd_p = 0;
...@@ -1301,7 +1302,7 @@ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring) ...@@ -1301,7 +1302,7 @@ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring)
rx_ring->rxbufs[last_idx].dma_addr = 0; rx_ring->rxbufs[last_idx].dma_addr = 0;
rx_ring->rxbufs[last_idx].frag = NULL; rx_ring->rxbufs[last_idx].frag = NULL;
memset(rx_ring->rxds, 0, sizeof(*rx_ring->rxds) * rx_ring->cnt); memset(rx_ring->rxds, 0, rx_ring->size);
rx_ring->wr_p = 0; rx_ring->wr_p = 0;
rx_ring->rd_p = 0; rx_ring->rd_p = 0;
} }
...@@ -2154,7 +2155,7 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring) ...@@ -2154,7 +2155,7 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
tx_ring->cnt = dp->txd_cnt; tx_ring->cnt = dp->txd_cnt;
tx_ring->size = sizeof(*tx_ring->txds) * tx_ring->cnt; tx_ring->size = array_size(tx_ring->cnt, sizeof(*tx_ring->txds));
tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size, tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size,
&tx_ring->dma, GFP_KERNEL); &tx_ring->dma, GFP_KERNEL);
if (!tx_ring->txds) if (!tx_ring->txds)
...@@ -2308,7 +2309,7 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring) ...@@ -2308,7 +2309,7 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
} }
rx_ring->cnt = dp->rxd_cnt; rx_ring->cnt = dp->rxd_cnt;
rx_ring->size = sizeof(*rx_ring->rxds) * rx_ring->cnt; rx_ring->size = array_size(rx_ring->cnt, sizeof(*rx_ring->rxds));
rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size, rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size,
&rx_ring->dma, GFP_KERNEL); &rx_ring->dma, GFP_KERNEL);
if (!rx_ring->rxds) if (!rx_ring->rxds)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment