| Message ID | 20211109114159.GA15855@kili (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | [net-next] net/mlx5e: Fix signedness bugs in mlx5e_build_shampo_hd_umr() | expand |
Grr... I didn't mean to put net-next in the Subject or Cc Jakub. Sorry about that. This isn't a net/ thing. regards, dan carpenter
Sorry for that, I will send today a fix that reduce the need for the internal(index) check. -----Original Message----- From: Dan Carpenter <dan.carpenter@oracle.com> Sent: Tuesday, November 9, 2021 1:42 PM To: Saeed Mahameed <saeedm@nvidia.com>; Ben Ben Ishay <benishay@nvidia.com> Cc: Leon Romanovsky <leon@kernel.org>; Jakub Kicinski <kuba@kernel.org>; Tariq Toukan <tariqt@nvidia.com>; linux-rdma@vger.kernel.org; kernel-janitors@vger.kernel.org Subject: [PATCH net-next] net/mlx5e: Fix signedness bugs in mlx5e_build_shampo_hd_umr() External email: Use caution opening links or attachments The error handling has a couple forever loops which will lead to a crash. Unsigned values are always greater or equal to zero. Fixes: 64509b052525 ("net/mlx5e: Add data path for SHAMPO feature") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c index 96967b0a2441..8cd120666b2d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -543,13 +543,14 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, u16 klm_entries, u16 index) { struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; - u16 entries, pi, i, header_offset, err, wqe_bbs, new_entries; + u16 entries, pi, header_offset, err, wqe_bbs, new_entries; u32 lkey = rq->mdev->mlx5e_res.hw_objs.mkey; struct page *page = shampo->last_page; u64 addr = shampo->last_addr; struct mlx5e_dma_info *dma_info; struct mlx5e_umr_wqe *umr_wqe; int headroom; + int i; headroom = rq->buff.headroom; new_entries = klm_entries - (shampo->pi & (MLX5_UMR_KLM_ALIGNMENT - 1)); @@ -601,8 +602,11 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, err_unmap: while (--i >= 0) { - if (--index < 0) + if (index == 0) index = shampo->hd_per_wq - 1; + else + index--; + dma_info = &shampo->info[index]; if (!(i & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1))) { dma_info->addr = ALIGN_DOWN(dma_info->addr, PAGE_SIZE); -- 2.20.1
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c index 96967b0a2441..8cd120666b2d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -543,13 +543,14 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, u16 klm_entries, u16 index) { struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; - u16 entries, pi, i, header_offset, err, wqe_bbs, new_entries; + u16 entries, pi, header_offset, err, wqe_bbs, new_entries; u32 lkey = rq->mdev->mlx5e_res.hw_objs.mkey; struct page *page = shampo->last_page; u64 addr = shampo->last_addr; struct mlx5e_dma_info *dma_info; struct mlx5e_umr_wqe *umr_wqe; int headroom; + int i; headroom = rq->buff.headroom; new_entries = klm_entries - (shampo->pi & (MLX5_UMR_KLM_ALIGNMENT - 1)); @@ -601,8 +602,11 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, err_unmap: while (--i >= 0) { - if (--index < 0) + if (index == 0) index = shampo->hd_per_wq - 1; + else + index--; + dma_info = &shampo->info[index]; if (!(i & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1))) { dma_info->addr = ALIGN_DOWN(dma_info->addr, PAGE_SIZE);
The error handling has a couple forever loops which will lead to a crash. Unsigned values are always greater or equal to zero. Fixes: 64509b052525 ("net/mlx5e: Add data path for SHAMPO feature") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)