| Message ID | 20240401082620.608675-1-aaprelkov@usergate.com (mailing list archive) |
|---|---|
| State | Rejected |
| Delegated to: | Herbert Xu |
| Headers | show |
| Series | crypto: caam/qi2 - check for 0 rx/tx queues on setup | expand |
On 4/1/2024 11:26 AM, Aleksandr Aprelkov wrote: > If num_rx_queues or num_tx_queues is 0, then division by zero occurs > on j calculation. > Also goto mark "err_get_rx_queue" used for tx queues too. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 8d818c105501 ("crypto: caam/qi2 - add DPAA2-CAAM driver") > Signed-off-by: Aleksandr Aprelkov <aaprelkov@usergate.com> > --- > drivers/crypto/caam/caamalg_qi2.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c > index a4f6884416a0..07cb1aad758f 100644 > --- a/drivers/crypto/caam/caamalg_qi2.c > +++ b/drivers/crypto/caam/caamalg_qi2.c > @@ -5049,6 +5049,11 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev) > > priv->num_pairs = min(priv->dpseci_attr.num_rx_queues, > priv->dpseci_attr.num_tx_queues); > + if (!priv->num_pairs) { > + err = -EINVAL; > + dev_err(dev, "one of queues number is 0\n"); > + goto err_get_queues; > + } dpseci objects are created in MC f/w using restool: https://github.com/nxp-qoriq/restool restool validates the user-provided attributes of these objects, including num_{rx,tx}_queues - which can't be zero, they must be at least 1. More details in source code: https://github.com/nxp-qoriq/restool/blob/master/dpseci_commands.c#L713 https://github.com/nxp-qoriq/restool/blob/master/dpseci_commands.c#L633 So thanks, but I don't think this check is required. Horia
diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c index a4f6884416a0..07cb1aad758f 100644 --- a/drivers/crypto/caam/caamalg_qi2.c +++ b/drivers/crypto/caam/caamalg_qi2.c @@ -5049,6 +5049,11 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev) priv->num_pairs = min(priv->dpseci_attr.num_rx_queues, priv->dpseci_attr.num_tx_queues); + if (!priv->num_pairs) { + err = -EINVAL; + dev_err(dev, "one of queues number is 0\n"); + goto err_get_queues; + } if (priv->num_pairs > num_online_cpus()) { dev_warn(dev, "%d queues won't be used\n", priv->num_pairs - num_online_cpus()); @@ -5060,7 +5065,7 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev) &priv->rx_queue_attr[i]); if (err) { dev_err(dev, "dpseci_get_rx_queue() failed\n"); - goto err_get_rx_queue; + goto err_get_queues; } } @@ -5069,7 +5074,7 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev) &priv->tx_queue_attr[i]); if (err) { dev_err(dev, "dpseci_get_tx_queue() failed\n"); - goto err_get_rx_queue; + goto err_get_queues; } } @@ -5105,7 +5110,7 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev) return 0; -err_get_rx_queue: +err_get_queues: dpaa2_dpseci_congestion_free(priv); err_get_vers: dpseci_close(priv->mc_io, 0, ls_dev->mc_handle);
If num_rx_queues or num_tx_queues is 0, then division by zero occurs on j calculation. Also goto mark "err_get_rx_queue" used for tx queues too. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 8d818c105501 ("crypto: caam/qi2 - add DPAA2-CAAM driver") Signed-off-by: Aleksandr Aprelkov <aaprelkov@usergate.com> --- drivers/crypto/caam/caamalg_qi2.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)