| From c7e898652448fcd453db8f3245203fb0fd2fa595 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 30 May 2021 12:03:49 +0300 |
| Subject: vdpa/mlx5: Fix possible failure in umem size calculation |
| |
| From: Eli Cohen <elic@nvidia.com> |
| |
| [ Upstream commit 71ab6a7cfbae27f86a3901daab10bfe13b3a1e3a ] |
| |
| umem size is a 32 bit unsigned value so assigning it to an int could |
| cause false failures. Set the calculated value inside the function and |
| modify function name to reflect the fact it updates the size. |
| |
| This bug was found during code review but never had real impact to this |
| date. |
| |
| Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices") |
| Signed-off-by: Eli Cohen <elic@nvidia.com> |
| Link: https://lore.kernel.org/r/20210530090349.8360-1-elic@nvidia.com |
| Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
| Acked-by: Jason Wang <jasowang@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/vdpa/mlx5/net/mlx5_vnet.c | 15 +++++---------- |
| 1 file changed, 5 insertions(+), 10 deletions(-) |
| |
| diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c |
| index fc7834a34695..d5ea956a3a3a 100644 |
| --- a/drivers/vdpa/mlx5/net/mlx5_vnet.c |
| +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c |
| @@ -611,8 +611,8 @@ static void cq_destroy(struct mlx5_vdpa_net *ndev, u16 idx) |
| mlx5_db_free(ndev->mvdev.mdev, &vcq->db); |
| } |
| |
| -static int umem_size(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *mvq, int num, |
| - struct mlx5_vdpa_umem **umemp) |
| +static void set_umem_size(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *mvq, int num, |
| + struct mlx5_vdpa_umem **umemp) |
| { |
| struct mlx5_core_dev *mdev = ndev->mvdev.mdev; |
| int p_a; |
| @@ -635,7 +635,7 @@ static int umem_size(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *mvq |
| *umemp = &mvq->umem3; |
| break; |
| } |
| - return p_a * mvq->num_ent + p_b; |
| + (*umemp)->size = p_a * mvq->num_ent + p_b; |
| } |
| |
| static void umem_frag_buf_free(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_umem *umem) |
| @@ -651,15 +651,10 @@ static int create_umem(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *m |
| void *in; |
| int err; |
| __be64 *pas; |
| - int size; |
| struct mlx5_vdpa_umem *umem; |
| |
| - size = umem_size(ndev, mvq, num, &umem); |
| - if (size < 0) |
| - return size; |
| - |
| - umem->size = size; |
| - err = umem_frag_buf_alloc(ndev, umem, size); |
| + set_umem_size(ndev, mvq, num, &umem); |
| + err = umem_frag_buf_alloc(ndev, umem, umem->size); |
| if (err) |
| return err; |
| |
| -- |
| 2.30.2 |
| |