diff mbox series

net: ethernet: renesas: rswitch: Fix endless loop in error paths

Message ID 20221107081021.2955122-1-yoshihiro.shimoda.uh@renesas.com (mailing list archive)
State Accepted
Commit 380f9acdf74729d79972b947820f00b42cc26dae
Delegated to: Netdev Maintainers
Headers show
Series net: ethernet: renesas: rswitch: Fix endless loop in error paths | expand

Checks

Context Check Description
netdev/tree_selection success Guessed tree name to be net-next
netdev/fixes_present success Fixes tag not required for -next series
netdev/subject_prefix warning Target tree name not specified in the subject
netdev/cover_letter success Single patches do not need cover letters
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers fail 1 blamed authors not CCed: andrew@lunn.ch; 3 maintainers not CCed: andrew@lunn.ch s.shtylyov@omp.ru nathan@kernel.org
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch warning WARNING: line length of 85 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0

Commit Message

Yoshihiro Shimoda Nov. 7, 2022, 8:10 a.m. UTC 
Coverity reported that the error path in rswitch_gwca_queue_alloc_skb()
has an issue to cause endless loop. So, fix the issue by changing
variables' types from u32 to int. After changed the types,
rswitch_tx_free() should use rswitch_get_num_cur_queues() to
calculate number of current queues.

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527147 ("Control flow issues")
Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
---
 drivers/net/ethernet/renesas/rswitch.c | 17 +++++++++--------
 drivers/net/ethernet/renesas/rswitch.h |  6 +++---
 2 files changed, 12 insertions(+), 11 deletions(-)

Comments

patchwork-bot+netdevbpf@kernel.org Nov. 9, 2022, 2 a.m. UTC | #1 
Hello:

This patch was applied to netdev/net-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  7 Nov 2022 17:10:21 +0900 you wrote:
> Coverity reported that the error path in rswitch_gwca_queue_alloc_skb()
> has an issue to cause endless loop. So, fix the issue by changing
> variables' types from u32 to int. After changed the types,
> rswitch_tx_free() should use rswitch_get_num_cur_queues() to
> calculate number of current queues.
> 
> Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
> Addresses-Coverity-ID: 1527147 ("Control flow issues")
> Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"")
> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> 
> [...]

Here is the summary with links:
  - net: ethernet: renesas: rswitch: Fix endless loop in error paths
    https://git.kernel.org/netdev/net-next/c/380f9acdf747

You are awesome, thank you!
diff mbox series

Patch

diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c
index f0168fedfef9..3bd5e6239855 100644
--- a/drivers/net/ethernet/renesas/rswitch.c
+++ b/drivers/net/ethernet/renesas/rswitch.c
@@ -219,9 +219,9 @@  static void rswitch_ack_data_irq(struct rswitch_private *priv, int index)
 	iowrite32(BIT(index % 32), priv->addr + offs);
 }
 
-static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32 num)
+static int rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, int num)
 {
-	u32 index = cur ? gq->cur : gq->dirty;
+	int index = cur ? gq->cur : gq->dirty;
 
 	if (index + num >= gq->ring_size)
 		index = (index + num) % gq->ring_size;
@@ -231,7 +231,7 @@  static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32
 	return index;
 }
 
-static u32 rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq)
+static int rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq)
 {
 	if (gq->cur >= gq->dirty)
 		return gq->cur - gq->dirty;
@@ -250,9 +250,9 @@  static bool rswitch_is_queue_rxed(struct rswitch_gwca_queue *gq)
 }
 
 static int rswitch_gwca_queue_alloc_skb(struct rswitch_gwca_queue *gq,
-					u32 start_index, u32 num)
+					int start_index, int num)
 {
-	u32 i, index;
+	int i, index;
 
 	for (i = 0; i < num; i++) {
 		index = (i + start_index) % gq->ring_size;
@@ -410,12 +410,12 @@  static int rswitch_gwca_queue_format(struct net_device *ndev,
 
 static int rswitch_gwca_queue_ts_fill(struct net_device *ndev,
 				      struct rswitch_gwca_queue *gq,
-				      u32 start_index, u32 num)
+				      int start_index, int num)
 {
 	struct rswitch_device *rdev = netdev_priv(ndev);
 	struct rswitch_ext_ts_desc *desc;
 	dma_addr_t dma_addr;
-	u32 i, index;
+	int i, index;
 
 	for (i = 0; i < num; i++) {
 		index = (i + start_index) % gq->ring_size;
@@ -736,7 +736,8 @@  static int rswitch_tx_free(struct net_device *ndev, bool free_txed_only)
 	int free_num = 0;
 	int size;
 
-	for (; gq->cur - gq->dirty > 0; gq->dirty = rswitch_next_queue_index(gq, false, 1)) {
+	for (; rswitch_get_num_cur_queues(gq) > 0;
+	     gq->dirty = rswitch_next_queue_index(gq, false, 1)) {
 		desc = &gq->ring[gq->dirty];
 		if (free_txed_only && (desc->desc.die_dt & DT_MASK) != DT_FEMPTY)
 			break;
diff --git a/drivers/net/ethernet/renesas/rswitch.h b/drivers/net/ethernet/renesas/rswitch.h
index 778177ec8d4f..edbdd1b98d3d 100644
--- a/drivers/net/ethernet/renesas/rswitch.h
+++ b/drivers/net/ethernet/renesas/rswitch.h
@@ -908,9 +908,9 @@  struct rswitch_gwca_queue {
 		struct rswitch_ext_ts_desc *ts_ring;
 	};
 	dma_addr_t ring_dma;
-	u32 ring_size;
-	u32 cur;
-	u32 dirty;
+	int ring_size;
+	int cur;
+	int dirty;
 	struct sk_buff **skbs;
 
 	struct net_device *ndev;	/* queue to ndev for irq */