[PATCH net-next] net/mlx5e: Fix signedness bugs in mlx5e_build_shampo_hd_umr()

[PATCH net-next] net/mlx5e: Fix signedness bugs in mlx5e_build_shampo_hd_umr()

[Dan Carpenter]

The error handling has a couple forever loops which will lead to a
crash.  Unsigned values are always greater or equal to zero.

Fixes: 64509b052525 ("net/mlx5e: Add data path for SHAMPO feature")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 96967b0a2441..8cd120666b2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -543,13 +543,14 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq,
 				     u16 klm_entries, u16 index)
 {
 	struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo;
-	u16 entries, pi, i, header_offset, err, wqe_bbs, new_entries;
+	u16 entries, pi, header_offset, err, wqe_bbs, new_entries;
 	u32 lkey = rq->mdev->mlx5e_res.hw_objs.mkey;
 	struct page *page = shampo->last_page;
 	u64 addr = shampo->last_addr;
 	struct mlx5e_dma_info *dma_info;
 	struct mlx5e_umr_wqe *umr_wqe;
 	int headroom;
+	int i;
 
 	headroom = rq->buff.headroom;
 	new_entries = klm_entries - (shampo->pi & (MLX5_UMR_KLM_ALIGNMENT - 1));
@@ -601,8 +602,11 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq,
 
 err_unmap:
 	while (--i >= 0) {
-		if (--index < 0)
+		if (index == 0)
 			index = shampo->hd_per_wq - 1;
+		else
+			index--;
+
 		dma_info = &shampo->info[index];
 		if (!(i & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1))) {
 			dma_info->addr = ALIGN_DOWN(dma_info->addr, PAGE_SIZE);
-- 
2.20.1

Re: [PATCH net-next] net/mlx5e: Fix signedness bugs in mlx5e_build_shampo_hd_umr()

[Dan Carpenter]

Grr...  I didn't mean to put net-next in the Subject or Cc Jakub.
Sorry about that.  This isn't a net/ thing.

regards,
dan carpenter

RE: [PATCH net-next] net/mlx5e: Fix signedness bugs in mlx5e_build_shampo_hd_umr()

[Ben Ben Ishay]

Sorry for that, I will send today a fix that reduce the need for the internal(index) check.

-----Original Message-----
From: Dan Carpenter <dan.carpenter@oracle.com> 
Sent: Tuesday, November 9, 2021 1:42 PM
To: Saeed Mahameed <saeedm@nvidia.com>; Ben Ben Ishay <benishay@nvidia.com>
Cc: Leon Romanovsky <leon@kernel.org>; Jakub Kicinski <kuba@kernel.org>; Tariq Toukan <tariqt@nvidia.com>; linux-rdma@vger.kernel.org; kernel-janitors@vger.kernel.org
Subject: [PATCH net-next] net/mlx5e: Fix signedness bugs in mlx5e_build_shampo_hd_umr()

External email: Use caution opening links or attachments


The error handling has a couple forever loops which will lead to a crash.  Unsigned values are always greater or equal to zero.

Fixes: 64509b052525 ("net/mlx5e: Add data path for SHAMPO feature")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 96967b0a2441..8cd120666b2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -543,13 +543,14 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq,
                                     u16 klm_entries, u16 index)  {
        struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo;
-       u16 entries, pi, i, header_offset, err, wqe_bbs, new_entries;
+       u16 entries, pi, header_offset, err, wqe_bbs, new_entries;
        u32 lkey = rq->mdev->mlx5e_res.hw_objs.mkey;
        struct page *page = shampo->last_page;
        u64 addr = shampo->last_addr;
        struct mlx5e_dma_info *dma_info;
        struct mlx5e_umr_wqe *umr_wqe;
        int headroom;
+       int i;

        headroom = rq->buff.headroom;
        new_entries = klm_entries - (shampo->pi & (MLX5_UMR_KLM_ALIGNMENT - 1)); @@ -601,8 +602,11 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq,

 err_unmap:
        while (--i >= 0) {
-               if (--index < 0)
+               if (index == 0)
                        index = shampo->hd_per_wq - 1;
+               else
+                       index--;
+
                dma_info = &shampo->info[index];
                if (!(i & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1))) {
                        dma_info->addr = ALIGN_DOWN(dma_info->addr, PAGE_SIZE);
--
2.20.1