Commit 380f9acd authored by Yoshihiro Shimoda's avatar Yoshihiro Shimoda Committed by Jakub Kicinski
Browse files

net: ethernet: renesas: rswitch: Fix endless loop in error paths 



Coverity reported that the error path in rswitch_gwca_queue_alloc_skb()
has an issue to cause endless loop. So, fix the issue by changing
variables' types from u32 to int. After changed the types,
rswitch_tx_free() should use rswitch_get_num_cur_queues() to
calculate number of current queues.

Reported-by: default avatarcoverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527147 ("Control flow issues")
Fixes: 3590918b ("net: ethernet: renesas: Add support for "Ethernet Switch"")
Signed-off-by: default avatarYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20221107081021.2955122-1-yoshihiro.shimoda.uh@renesas.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 8e18be76

drivers/net/ethernet/renesas/rswitch.c

+9 −8
Original line number Diff line number Diff line
@@ -219,9 +219,9 @@ static void rswitch_ack_data_irq(struct rswitch_private *priv, int index) 
	iowrite32(BIT(index % 32), priv->addr + offs);

}



static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32 num)

static int rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, int num)

{

	u32 index = cur ? gq->cur : gq->dirty;

	int index = cur ? gq->cur : gq->dirty;



	if (index + num >= gq->ring_size)

		index = (index + num) % gq->ring_size;
@@ -231,7 +231,7 @@ static u32 rswitch_next_queue_index(struct rswitch_gwca_queue *gq, bool cur, u32 
	return index;

}



static u32 rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq)

static int rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq)

{

	if (gq->cur >= gq->dirty)

		return gq->cur - gq->dirty;
@@ -250,9 +250,9 @@ static bool rswitch_is_queue_rxed(struct rswitch_gwca_queue *gq) 
}



static int rswitch_gwca_queue_alloc_skb(struct rswitch_gwca_queue *gq,

					u32 start_index, u32 num)

					int start_index, int num)

{

	u32 i, index;

	int i, index;



	for (i = 0; i < num; i++) {

		index = (i + start_index) % gq->ring_size;
@@ -410,12 +410,12 @@ static int rswitch_gwca_queue_format(struct net_device *ndev, 


static int rswitch_gwca_queue_ts_fill(struct net_device *ndev,

				      struct rswitch_gwca_queue *gq,

				      u32 start_index, u32 num)

				      int start_index, int num)

{

	struct rswitch_device *rdev = netdev_priv(ndev);

	struct rswitch_ext_ts_desc *desc;

	dma_addr_t dma_addr;

	u32 i, index;

	int i, index;



	for (i = 0; i < num; i++) {

		index = (i + start_index) % gq->ring_size;
@@ -736,7 +736,8 @@ static int rswitch_tx_free(struct net_device *ndev, bool free_txed_only) 
	int free_num = 0;

	int size;



	for (; gq->cur - gq->dirty > 0; gq->dirty = rswitch_next_queue_index(gq, false, 1)) {

	for (; rswitch_get_num_cur_queues(gq) > 0;

	     gq->dirty = rswitch_next_queue_index(gq, false, 1)) {

		desc = &gq->ring[gq->dirty];

		if (free_txed_only && (desc->desc.die_dt & DT_MASK) != DT_FEMPTY)

			break;

drivers/net/ethernet/renesas/rswitch.h

+3 −3
Original line number Diff line number Diff line
@@ -908,9 +908,9 @@ struct rswitch_gwca_queue { 
		struct rswitch_ext_ts_desc *ts_ring;

	};

	dma_addr_t ring_dma;

	u32 ring_size;

	u32 cur;

	u32 dirty;

	int ring_size;

	int cur;

	int dirty;

	struct sk_buff **skbs;



	struct net_device *ndev;	/* queue to ndev for irq */