mirror of
https://github.com/edk2-porting/linux-next.git
synced 2025-01-26 23:55:40 +08:00
nfp: protect from theoretical size overflows on HW descriptor ring
Use array_size() and store the size as full size_t to protect from theoretical size overflow when handling HW descriptor rings. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
e76c1d3d2a
commit
5ea14712d7
@ -250,7 +250,7 @@ struct nfp_net_tx_ring {
|
||||
struct nfp_net_tx_desc *txds;
|
||||
|
||||
dma_addr_t dma;
|
||||
unsigned int size;
|
||||
size_t size;
|
||||
bool is_xdp;
|
||||
} ____cacheline_aligned;
|
||||
|
||||
@ -372,7 +372,7 @@ struct nfp_net_rx_ring {
|
||||
struct xdp_rxq_info xdp_rxq;
|
||||
|
||||
dma_addr_t dma;
|
||||
unsigned int size;
|
||||
size_t size;
|
||||
} ____cacheline_aligned;
|
||||
|
||||
/**
|
||||
|
@ -54,6 +54,7 @@
|
||||
#include <linux/ip.h>
|
||||
#include <linux/ipv6.h>
|
||||
#include <linux/mm.h>
|
||||
#include <linux/overflow.h>
|
||||
#include <linux/page_ref.h>
|
||||
#include <linux/pci.h>
|
||||
#include <linux/pci_regs.h>
|
||||
@ -1121,7 +1122,7 @@ nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
|
||||
tx_ring->rd_p++;
|
||||
}
|
||||
|
||||
memset(tx_ring->txds, 0, sizeof(*tx_ring->txds) * tx_ring->cnt);
|
||||
memset(tx_ring->txds, 0, tx_ring->size);
|
||||
tx_ring->wr_p = 0;
|
||||
tx_ring->rd_p = 0;
|
||||
tx_ring->qcp_rd_p = 0;
|
||||
@ -1301,7 +1302,7 @@ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring)
|
||||
rx_ring->rxbufs[last_idx].dma_addr = 0;
|
||||
rx_ring->rxbufs[last_idx].frag = NULL;
|
||||
|
||||
memset(rx_ring->rxds, 0, sizeof(*rx_ring->rxds) * rx_ring->cnt);
|
||||
memset(rx_ring->rxds, 0, rx_ring->size);
|
||||
rx_ring->wr_p = 0;
|
||||
rx_ring->rd_p = 0;
|
||||
}
|
||||
@ -2154,7 +2155,7 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
|
||||
|
||||
tx_ring->cnt = dp->txd_cnt;
|
||||
|
||||
tx_ring->size = sizeof(*tx_ring->txds) * tx_ring->cnt;
|
||||
tx_ring->size = array_size(tx_ring->cnt, sizeof(*tx_ring->txds));
|
||||
tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size,
|
||||
&tx_ring->dma, GFP_KERNEL);
|
||||
if (!tx_ring->txds)
|
||||
@ -2308,7 +2309,7 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
|
||||
}
|
||||
|
||||
rx_ring->cnt = dp->rxd_cnt;
|
||||
rx_ring->size = sizeof(*rx_ring->rxds) * rx_ring->cnt;
|
||||
rx_ring->size = array_size(rx_ring->cnt, sizeof(*rx_ring->rxds));
|
||||
rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size,
|
||||
&rx_ring->dma, GFP_KERNEL);
|
||||
if (!rx_ring->rxds)
|
||||
|
Loading…
Reference in New Issue
Block a user