nfp: protect from theoretical size overflows on HW descriptor ring

Use array_size() and store the size as full size_t to protect from
theoretical size overflow when handling HW descriptor rings.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h
index 607896910fb0d6b321fec1bac809a7ed42cdddd6..439e6ffe2f0538bbc7c2aa99daafd5377fb95f86 100644 (file)
--- a/drivers/net/ethernet/netronome/nfp/nfp_net.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h
@@ -250,7 +250,7 @@ struct nfp_net_tx_ring {
        struct nfp_net_tx_desc *txds;
 
        dma_addr_t dma;
-       unsigned int size;
+       size_t size;
        bool is_xdp;
 } ____cacheline_aligned;
 
@@ -372,7 +372,7 @@ struct nfp_net_rx_ring {
        struct xdp_rxq_info xdp_rxq;
 
        dma_addr_t dma;
-       unsigned int size;
+       size_t size;
 } ____cacheline_aligned;
 
 /**

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index d02baefcb350d295db1c8acf37da957378b1cc50..7c1a921d178d452eb0f4a88e619af89af8032b01 100644 (file)
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -54,6 +54,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/mm.h>
+#include <linux/overflow.h>
 #include <linux/page_ref.h>
 #include <linux/pci.h>
 #include <linux/pci_regs.h>
@@ -1121,7 +1122,7 @@ nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
                tx_ring->rd_p++;
        }
 
-       memset(tx_ring->txds, 0, sizeof(*tx_ring->txds) * tx_ring->cnt);
+       memset(tx_ring->txds, 0, tx_ring->size);
        tx_ring->wr_p = 0;
        tx_ring->rd_p = 0;
        tx_ring->qcp_rd_p = 0;
@@ -1301,7 +1302,7 @@ static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring)
        rx_ring->rxbufs[last_idx].dma_addr = 0;
        rx_ring->rxbufs[last_idx].frag = NULL;
 
-       memset(rx_ring->rxds, 0, sizeof(*rx_ring->rxds) * rx_ring->cnt);
+       memset(rx_ring->rxds, 0, rx_ring->size);
        rx_ring->wr_p = 0;
        rx_ring->rd_p = 0;
 }
@@ -2154,7 +2155,7 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
 
        tx_ring->cnt = dp->txd_cnt;
 
-       tx_ring->size = sizeof(*tx_ring->txds) * tx_ring->cnt;
+       tx_ring->size = array_size(tx_ring->cnt, sizeof(*tx_ring->txds));
        tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size,
                                            &tx_ring->dma, GFP_KERNEL);
        if (!tx_ring->txds)
@@ -2308,7 +2309,7 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
        }
 
        rx_ring->cnt = dp->rxd_cnt;
-       rx_ring->size = sizeof(*rx_ring->rxds) * rx_ring->cnt;
+       rx_ring->size = array_size(rx_ring->cnt, sizeof(*rx_ring->rxds));
        rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size,
                                            &rx_ring->dma, GFP_KERNEL);
        if (!rx_ring->rxds)